Cases › security breach › LR-2026-0812

Northflank platform breach exposes customer environment variables and AI API keys

Preliminary Why: Publisher not yet named · subject to change

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: fix reported

Severity major

Reported 30 Oct 2026

Industry cloud computing / platform services

No source states: loss or records, developer and model, agent tool, could do, deployer.

Severity major: Live production compromise of a shared cloud platform with customer credentials stolen and unauthorized use of AI API keys reported; scope unbounded as Northflank has not said how many customers were affected.

Northflank, a cloud platform for deploying applications, containers, databases and AI applications, suffered a security breach that led to unauthorized use of customers' AI API keys. It disclosed the incident Oct. 30 after a threat alert from cloud security firm Wiz; engineers reviewed the warning within a minute and applied network policy patches. At 13:58 UTC Northflank told customers to assume all their environment variables had been decrypted and the secrets stolen, and to disable or rotate all keys. At 23:38 UTC it said users had reported unauthorized use of AI API keys supplied to the platform. It enabled credential rotation for several databases and turned on audit logs for all customers. Northflank has not said how attackers gained access or how many customers were affected.

What happened

No source tells the story step by step yet.

What was done

Fix reported

“It enabled credential rotation for PostgreSQL, MongoDB, MySQL and Redis and turned on audit logs for all customers, including those with free accounts.”

Risks

AI used to run a cyber attack
Primary99 incidents
Rising: 25 vs 4.0 a week

AI system attacked or breached
Also20 incidents

Sorted by rule from the case's fields; not yet read from the sources.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Model

Safety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring

Infrastructure / target

Known flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters

Evidence

What was done It enabled credential rotation for PostgreSQL, MongoDB, MySQL and Redis and turned on audit logs for all customers, including those with free accounts.

No source states: a step-by-step account, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show every field, with its source and grade