The status page lists major outages across seven components and advises immediate secret rotation after the breach.
NORTHFLANK BREACH EXPOSES ENVIRONMENT VARIABLES AND AI KEYS
*Northflank confirmed a major security incident on Oct. 30, 2026. *All user environment variables were decrypted, prompting immediate secret rotation. *The breach triggered network patches and external CIRT involvement.
Northflank announced a major security incident on October 30, 2026. The company’s status page confirmed that all user environment variables were decrypted, exposing configuration secrets across the platform. Multiple users reported unauthorized use of their AI keys, prompting an urgent call to rotate every secret. The breach unfolded in real time, with alerts, patches, and external CIRT support logged between 11:43 UTC and 13:05 UTC. Northflank’s response timeline shows a swift, layered defense, but the damage to secret integrity is clear. Users now face a race to secure their workloads before further exploitation.
What data was exposed in the Northflank breach?
Northflank’s status page states that every user’s environment variables were decrypted. The company enabled secret rotation on Postgres and MongoDB for all users at 3:12 PM UTC. Multiple users reported that their AI keys had been used. The notice advises disabling public exposure on addons and rotating all keys immediately. No other data categories are mentioned. The breach therefore centers on configuration secrets rather than user‑generated content.
How did Northflank respond to the threat?
The timeline shows a rapid response. At 11:43 UTC a Wiz threat alert was issued, followed by engineer review at 11:44 UTC. An initial network policy patch was deployed at 12:02 UTC, with additional patches at 12:50 UTC and twice at 13:05 UTC. At 13:00 UTC Northflank requested Wiz CIRT support. By 3:12 PM UTC secret rotation on databases was enabled. The sequence indicates a coordinated effort to contain the breach and secure the platform.
Which Northflank services suffered outages?
The status page lists seven platform components with a combined 99.80% uptime. All seven—Networking, Certificates, Services, Addons, Jobs, Builds, and Logs & Metrics—were marked as major outages during the incident. By contrast, the Northflank App maintained 99.82% uptime, the API showed 100.0% uptime, and the Marketing Site and Documentation each reported 100.0% uptime. The disparity suggests the breach impacted backend infrastructure while front‑end services remained largely functional.
What steps must users take now?
Northflank advises every user to assume their environment variables are compromised. Users should disable any public exposure on addons, rotate all database secrets, and generate new API and AI keys. Immediate rotation of Postgres and MongoDB credentials is required. The company’s guidance emphasizes that no further action beyond secret rotation is documented, leaving users to audit their own workloads for residual risk.
Frequently asked questions
When did the Northflank breach occur?
The breach was identified on October 30, 2026, with key events logged between 1:40 UTC and 3:12 UTC.
What immediate actions did Northflank recommend?
Northflank told users to assume all environment variables were decrypted, disable public addon exposure, and rotate all keys immediately.
Which components experienced major outages?
Networking, Certificates, Services, Addons, Jobs, Builds, and Logs & Metrics were all marked as major outages during the incident.
The breach underscores the fragility of cloud‑native secret management. Northflank’s rapid patching bought time, but the exposure of AI keys and decrypted variables signals a deeper supply‑chain risk. As users scramble to rotate credentials, the incident will likely drive tighter controls on public addon exposure and more rigorous secret‑rotation policies across the industry.
Sources: [Hacker News – Northflank Breached, https://status.northflank.com]