Security incident

Update timeline

1. investigating Oct 30, 2026, 01:40 PM UTC

   Rotate environment variables immediately. 11:43 UTC: Wiz threat alert 11:44 UTC: Northflank engineers review the alert 12:02 UTC: Initial network policy patch 12:50 UTC: Additional patching deployed 13:00 UTC: Wiz CIRT support requested 13:05 UTC: Additional patching deployed 13:05 UTC: Additional patching deployed

2. identified Oct 30, 2026, 01:58 PM UTC

   Assume all environment variables have been decrypted. Disable/rotate all keys.

3. identified Oct 30, 2026, 03:12 PM UTC

   All users should assume their environment variables are decrypted and begin rotation immediately. Secrets on workloads Secret groups Global secrets Multiple users are confirming that their AI keys have been used.

4. identified Oct 30, 2026, 07:28 PM UTC

   Our investigation is ongoing. We have no further confirmed findings to share at this time. Our guidance remains unchanged: assume all environment variables have been compromised and rotate all secrets and credentials immediately, including those in workloads, secret groups and global secrets. Disable public access to addons where enabled. We will share further updates as more information is confirmed.

5. identified Oct 30, 2026, 11:38 PM UTC

   Users have reported unauthorised use of AI API keys supplied to the Northflank platform. If you have not already rotated your user-provided secrets stored in Northflank, please do so immediately. Revoke existing credentials with their issuing providers, generate replacements, and update the affected secrets and workloads in Northflank. Review your AI provider usage and billing logs for unexpected activity, and report any suspicious usage to Northflank support and the relevant provider. These reports may be consistent with the broader pattern of attacks targeting AI credentials. Similar IP addresses are contained in this article [Wiz’s “Black October” report](https://www.wiz.io/blog/black-october-for-ai-developer-platforms).

6. identified Oct 31, 2026, 01:04 AM UTC

   We have enabled audit logs for all customers, including free users.

7. identified Oct 31, 2026, 01:34 PM UTC

   Secret rotation for MySQL and Redis is now available to all customers. Please rotate all secrets if you have not already.