Northflank Discloses Breach, Tells Customers to Rotate All Keys

Northflank disclosed a security incident on October 30 after receiving a threat alert from cloud security firm Wiz. The cloud application hosting platform told customers to assume all environment variables had been decrypted and to disable or rotate all keys, according to BleepingComputer.

Multiple Northflank customers reported unauthorized use of AI API keys they had supplied to the platform. In response, Northflank enabled credential rotation for PostgreSQL, MongoDB, MySQL and Redis, and turned on audit logs for all customers, including free-account users.

Wiz warned Northflank of the breach at 11:43 UTC on October 30, and engineers reviewed it one minute later. Northflank issued network policy patches at 12:50 UTC and 13:05 UTC and requested help from Wiz's incident response team.

Northflank has not disclosed how attackers gained access, how many customers were affected, or whether other credentials were abused. BleepingComputer contacted Northflank about the breach and had not received a response.

Earlier Wiz report

In October 2026, Wiz published a report titled "Black October for AI Developer Platforms" identifying at least nine security incidents affecting AI development platforms, including Northflank, Railway, OpenCode, Warp and Lightning AI. In two cases investigated by Wiz, compromised enterprise credentials were used to make about 2.5 million Amazon Bedrock API calls, generating roughly $100,000 in AI usage. Wiz has not confirmed that all nine incidents were carried out by the same attackers.