Skip to content
Northflank Security Breach: Immediate Action Required

Northflank Security Breach: Immediate Action Required

First seen 30 Oct 2026, 18:15 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •October 30, 2026 at 19:16 UTC
  • •Northflank users should rotate all keys immediately due to a security breach.
  • •Multiple users reported unauthorized use of AI keys linked to the incident.
  • •Major outages have affected networking, certificates, and services.

On October 30, 2026, Northflank reported a security incident affecting its users, with multiple reports of unauthorized use of AI keys. Users are advised to assume that their environment variables have been decrypted and to rotate all keys immediately. Secret rotation for Postgres and MongoDB has been enabled for all users, and disabling public exposure on addons is recommended. The incident was first identified at 1:40 PM UTC, with a threat alert from Wiz at 11:43 AM UTC. Northflank engineers implemented initial network policy patches and requested support from Wiz's Cyber Incident Response Team. The incident has led to major outages across various services, including networking and addons. The current status is that the Northflank App, API, marketing site, and documentation remain operational.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated just now How this analysis works

Timeline

2026-10-30
Security incident identified
Northflank identified a security incident at 1:40 PM UTC, prompting immediate action.
News.Ycombinator
2026-10-30
Threat alert issued
Wiz issued a threat alert at 11:43 AM UTC, leading to a review by Northflank engineers.
News.Ycombinator
2026-10-30
Secret rotation enabled
Northflank enabled secret rotation for Postgres and MongoDB for all users at 3:12 PM UTC.
Status.Northflank

More articles in this cluster (2)

Following this threat?

Track Northflank in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (4)

1 / 2

Common questions

What actions should I take?
All users should rotate their environment variables and disable public exposure on addons.
What services are affected?
Major outages have been reported for networking, certificates, and various services.
Is there an ongoing investigation?
Yes, Northflank is actively investigating the incident and has engaged Wiz's Cyber Incident Response Team.