---
title: "Northflank Breach: Rotate Every Secret, AI Keys Abused"
url: https://erroneo.us/security/briefs/northflank-environment-variable-breach-ai-keys/
description: "Northflank says to assume every environment variable was decrypted after an Oct 30 breach, and customers report stolen AI keys in use. Rotate all secrets now."
type: security-brief
section: "Security Digest"
date_published: 2026-10-30
date_modified: 2026-11-01
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: []
severity: "critical"
exploited: "in-the-wild"
kev: false
license: All rights reserved. Quote with attribution and a link.
---

# Northflank Breach: Rotate Every Secret, AI Keys Abused

**Verdict: Act now.** If you keep any secret in Northflank, revoke and reissue it at its source today, starting with AI provider keys; Northflank tells every customer to assume their environment variables were decrypted, and stolen AI keys are already being used.

- **Who must act:** Every Northflank customer that stores API keys, AI provider keys, cloud credentials or database passwords in environment variables, secret groups or global secrets, or runs Northflank database add-ons.
- **Who can relax:** Teams that do not use Northflank; Northflank workloads that hold no secrets still need add-on credentials rotated but have little else to do.
- **Affected:** Secrets in Northflank workload environment variables, secret groups and global secrets (assume decrypted, per Northflank); AI provider API keys stored on Northflank (unauthorized use reported); Credentials for Northflank add-ons: PostgreSQL, MongoDB, MySQL, Redis, MinIO, RabbitMQ, especially those with public access enabled
- **Fixed:** No platform fix closes the exposure: rotate each secret at its issuing provider; Northflank deployed network policy patches on Oct 30, 2026 (root cause not disclosed as of Nov 1, 2026); Add-on credential rotation available for PostgreSQL and MongoDB (Oct 30), MySQL, Redis, MinIO and RabbitMQ (Oct 31, 2026); Audit logs enabled for all Northflank customers, including free accounts (Oct 31, 2026)
- **CVEs:** none
- **CISA KEV:** no · **Exploitation:** Exploited in the wild

## What to do

1. List every environment variable, secret group and global secret across all Northflank projects and treat each value as stolen.
2. Revoke and reissue AI provider keys first at the provider, then cloud IAM, payment and database credentials; deactivate the old values, not just the Northflank copy.
3. Rotate every add-on credential with Northflank's new rotation feature and disable public access on add-ons that do not need it.
4. Update Northflank secrets with the new values and redeploy workloads so they pick them up.
5. Review AI provider usage and billing for activity you did not generate, and report it to the provider and to Northflank support.
6. Read the Northflank audit log, now on for every account, for changes you did not make.

### How to check if you are affected

- Check AI provider usage dashboards and invoices for spikes since early October 2026, especially calls to newer, expensive models.
- On AWS Bedrock, filter CloudTrail for InvokeModel calls from unfamiliar IPs, heavy use of global.* or us.* cross-region inference profiles, Bedrock and EC2 quota enumeration, and PutAccountDataRetention attempts.
- Search provider and cloud logs for the IPs Wiz tied to stolen-key checks: 23.106.46.239, 38.246.114.118, 104.243.32.50 and 31.57.201.201.
- For add-ons that had public access, review database connection logs for clients outside your own workloads.

## What happened

On October 30, 2026, Northflank posted a security incident on its [status page](https://status.northflank.com/). Northflank is a cloud platform for deploying applications, containers, databases and AI workloads. The cloud security company Wiz had sent it a threat alert at 11:43 UTC. Northflank engineers responded within a minute, and the company deployed network policy patches at 12:02, 12:50 and 13:05 UTC. It also brought in Wiz's incident response team.

Northflank's guidance hardened over the next few hours. First it told customers to rotate their environment variables. Then it said: "Assume all environment variables have been decrypted. Disable/rotate all keys."

That evening Northflank confirmed that "users have reported unauthorised use of AI API keys supplied to the Northflank platform." It said the IP addresses customers reported match those in a Wiz report published the same day. On October 31 Northflank turned on audit logs for every account, including free ones. It also added one-click credential rotation for its MySQL, Redis, MinIO and RabbitMQ add-ons, after PostgreSQL and MongoDB the day before.

As of November 1, Northflank has not said:

- how the attacker got in
- when access began
- how many customers are affected
- whether credentials other than AI keys have been abused

[BleepingComputer](https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/) received no answers to its questions.

## Who is affected

Northflank tells all customers to act, not a subset. Exposure covers:

- secrets in workload environment variables, secret groups and global secrets
- credentials for managed database and storage add-ons

Add-ons with public access enabled are the most exposed, and Northflank says to switch that off. Anything an exposed key unlocks is at risk too: AI provider accounts, cloud accounts, payment processors, registries and source control.

## Do you really need to act?

**Yes.** The platform operator tells you to assume decryption, and abuse is already reported. This is not a theoretical exposure.

It also fits a pattern. Wiz's ["Black October" report](https://www.wiz.io/blog/black-october-for-ai-developer-platforms) counts nine incidents at AI developer platforms this month, from Fireworks AI on October 6 to Railway on October 20 and Northflank on October 30. Several involved stored environment variables holding AI service keys. Wiz describes the motive as LLMjacking: running models on the victim's bill, or reselling the access.

In two Amazon Bedrock cases Wiz investigated, stolen keys drove about 2.5 million calls, likely over $100,000 at list price. Wiz does not attribute those two cases to Northflank. Its point is how fast stolen AI keys turn into spending.

Rotate in this order:

1. AI provider keys
2. cloud IAM and payment keys
3. database and add-on credentials
4. registry and Git tokens
5. everything else

## What to do now

1. Export a list of every secret in every Northflank project, secret group and global secret.
2. Revoke each one **at the issuing provider** and create a replacement. Changing only the copy stored in Northflank achieves nothing. For an AWS access key, create the new key first, then run `aws iam update-access-key --user-name USER --access-key-id OLD_KEY_ID --status Inactive`.
3. Use Northflank's add-on credential rotation for PostgreSQL, MongoDB, MySQL, Redis, MinIO and RabbitMQ. Turn off public access on any add-on that doesn't need it.
4. Put the new values into Northflank and redeploy so running workloads stop using the old ones.
5. Report unexplained usage to the AI provider, which may be able to help with charges, and to Northflank support.

## How to tell if you were hit

Northflank has not published an exposure window. Wiz's campaign dates back to early October, so search at least that far.

- **AI providers:** look in usage dashboards and invoices for spend you did not generate, especially on the newest and most expensive models.
- **Amazon Bedrock:** Wiz saw these patterns:

   - a single validation `InvokeModel` soon after a key was stolen
   - heavy use of `global.*` or `us.*` cross-region inference profiles
   - a `boto3` script enumerating Bedrock and EC2 quotas
   - an attempted `PutAccountDataRetention` call

- **IP addresses:** Wiz lists four IPs used to check stolen keys: `23.106.46.239`, `38.246.114.118`, `104.243.32.50` and `31.57.201.201`. Abuse traffic rotated through hosting ranges, including PEG TECH (AS54600) and Scloud (AS142002).
- **Northflank:** read the newly enabled audit log, and check database logs on any add-on that was publicly reachable.

## Timeline

- Oct 6, 2026 — First of nine AI developer platform incidents in Wiz's October count (Fireworks AI).
- Oct 30, 2026 — Wiz alerts Northflank at 11:43 UTC, and network policy patches follow from 12:02 UTC. Northflank tells customers to assume all environment variables were decrypted and to rotate all keys, and enables PostgreSQL and MongoDB credential rotation. Customers report AI key abuse. Wiz publishes "Black October."
- Oct 31, 2026 — Northflank enables audit logs for all customers and adds rotation for MySQL, Redis, MinIO and RabbitMQ add-ons. BleepingComputer reports the breach.

## Sources

1. [Northflank Status — Security incident updates, Oct 30-31, 2026](https://status.northflank.com/)
2. [Wiz — Black October for AI developer platforms](https://www.wiz.io/blog/black-october-for-ai-developer-platforms)
3. [BleepingComputer — Northflank security breach leads to abuse of customers' AI API keys](https://www.bleepingcomputer.com/news/security/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys/)

---
Source page: https://erroneo.us/security/briefs/northflank-environment-variable-breach-ai-keys/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt