Back Status.Northflank

Security incident - Incident details - Northflank

Status.Northflank • October 30, 2026

Update · October 30, 2026 at 3:12 PM UTC Secret rotation on Postgres and MongoDB has been enabled for all users. We recommend disabling public expose on addons if you have enabled that. All users should assume their environment variables are decrypted and begin rotation immediately. Secrets on workloads Secret groups Global secrets Multiple users are confirming that their AI keys have been used.

Secret rotation on Postgres and MongoDB has been enabled for all users. We recommend disabling public expose on addons if you have enabled that.

All users should assume their environment variables are decrypted and begin rotation immediately. Secrets on workloads

Multiple users are confirming that their AI keys have been used.

Identified · October 30, 2026 at 1:58 PM UTC Assume all environment variables have been decrypted. Disable/rotate all keys.

Assume all environment variables have been decrypted. Disable/rotate all keys.

Investigating · October 30, 2026 at 1:40 PM UTC Rotate environment variables immediately. 11:43 UTC: Wiz threat alert 11:44 UTC: Northflank engineers review the alert 12:02 UTC: Initial network policy patch 12:50 UTC: Additional patching deployed 13:00 UTC: Wiz CIRT support requested 13:05 UTC: Additional patching deployed 13:05 UTC: Additional patching deployed

Rotate environment variables immediately.

11:43 UTC: Wiz threat alert

11:44 UTC: Northflank engineers review the alert

12:02 UTC: Initial network policy patch 12:50 UTC: Additional patching deployed

13:00 UTC: Wiz CIRT support requested

13:05 UTC: Additional patching deployed

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Northflank Security Breach: Immediate Action Required On October 30, 2026, Northflank reported a security incident affecting its users, with multiple reports of unauthorized use of AI keys. Users are advised to assume that their environment variables have been decrypted and to rotate all keys immediately. Secret rotation for Postgres and MongoDB has been enabled for all users, and disabling public exposure on addons is recommended. The incident was first identified at 1:40 PM UTC, with a threat alert from Wiz at 11:43 AM UTC. Northflank engineers implemented initial network policy patches and requested support from Wiz's Cyber Incident Response Team. The incident has led to major outages across various services, including networking and addons. The current status is that the Northflank App, API, marketing site, and documentation remain operational. 2 sources 65

Security incident - Incident details - Northflank

The full story

Extracted Entities

Companies (1)

Platforms (2)