Northflank Breached

Northflank declared a major security incident and partial outage on October 30, 2026, after receiving a threat alert from cybersecurity firm Wiz at 11:43 UTC. Engineers began reviewing it one minute later and deployed an initial network-policy patch at 12:02, followed by further patches at 12:50 and 13:05. Northflank requested incident-response support from Wiz’s Cyber Incident Response Team at 13:00. The status updates advised customers to rotate environment variables and disable or replace keys, escalating to a warning that users should assume all environment variables had been decrypted.

The incident potentially affects secrets stored in workloads, secret groups, and global secrets. Northflank reported that multiple users had confirmed their AI keys were being used, indicating that exposed credentials may already have been exploited. Seven platform components - networking, certificates, services, add-ons, jobs, builds, and logs and metrics - were marked as experiencing major outages. The Northflank app, API, marketing site, and documentation remained operational. The central concern is therefore both service disruption and the possible exposure and misuse of customer secrets; users are urged to rotate credentials immediately rather than wait for further findings.