Northflank says assume environment variables were decrypted and tells customers to rotate all secrets

Northflank published a security incident on its status page on October 30, 2026. Its first updates that day told customers to rotate environment variables immediately, then to assume all environment variables had been decrypted and to rotate all keys. It also said some users reported unauthorized use of AI API keys supplied to the Northflank platform, and pointed them to revoke those credentials with their issuing providers, update the secrets and workloads in Northflank, and review AI provider usage and billing logs.

What Northflank has confirmed so far

A November 2 update, marked Monitoring, says Northflank believes the attack vector was contained within an hour of the first alert, and that its investigation shows no sign the attacker was in its environment after the attack. It says running workloads were unaffected, that it has seen no sign workloads or workload data were accessed, and that evidence suggests the attack focused on secrets held in its control plane. Customers on forward-deployed or dedicated control planes are unaffected. Northflank says that where it could act on customers' behalf, it revoked Northflank access tokens and sessions, VCS integrations, and cross-account IAM roles and service accounts, so customers need to sign in again and reconnect integrations. Independent forensic auditors began reviewing the attack with Northflank, and a root cause analysis is promised once findings are confirmed. Separately, Northflank says it patched CVE-2026-98432 across its fleet, including BYOC clusters with an active integration. It has not said whether that CVE was how the attacker got in.

A November 6 update says the platform and customer workloads stayed online throughout the incident, and that Northflank has still found no evidence that customer workloads or workload data were accessed. It gives this timeline: the first known decryption of secrets between 02:39 UTC and 03:08 UTC on October 30, the first security platform alert at 11:43 UTC, the exploit patched within 60 minutes of notification, and customers notified within two hours. It says intermittent platform degradation came from a high volume of simultaneous customer redeployments and from later key rotation and platform hardening. It says Northflank worked with upstream providers to revoke credentials where possible, and that investigation and independent forensic review remain ongoing.

What Northflank asks you to do

Northflank's guidance is to rotate all integration and project secrets if you have not already, review provider logs for unusual activity, and enable IP restrictions and budget limits wherever available. Its November 2 update recommends starting with AI provider keys, cloud provider credentials, payment provider keys, private keys, and database and other service credentials, and contacting AI providers such as OpenAI and Anthropic if you have seen unexpected AI usage or spend.

Our advice, not Northflank's: revoke each secret at the service that issued it, then set the new value in Northflank and redeploy. Changing the value in Northflank alone does not revoke the old key. Because Northflank has not published a root cause or a full list of affected customers on the shared control plane, treat the rotation guidance as applying until Northflank tells you otherwise.