Which secrets should I rotate after the Northflank breach?

Northflank asks users to rotate all secrets and credentials stored on its platform, including those on workloads, in secret groups and in global secrets. Users should also revoke AI provider keys with the issuing provider, create replacements, update the affected workloads, and disable public access to addons where it is enabled.

How do I check whether my AI API keys from Northflank were abused?

Northflank tells users to review their AI provider usage and billing logs for unexpected activity, and to report suspicious usage both to Northflank support and to the provider. Northflank also turned on audit logs for every customer, including free users, on October 31, so teams can review account activity.

Is the Northflank breach part of a wider attack on AI platforms?

Northflank says the reports may fit a broader pattern of attacks on AI credentials and points to Wiz's "Black October" report, which contains similar IP addresses. Wiz counts at least nine AI developer platforms that disclosed incidents in October 2026, including Fireworks AI, OpenCode, Railway, Warp and Northflank.

How much damage can stolen AI API keys cause?

Wiz's Black October report describes two stolen enterprise keys it watched. One made about 800,000 Amazon Bedrock calls over roughly thirty hours, and the other about 1.7 million calls over thirteen hours. Wiz estimates the two cases alone likely ran up over $100,000 in usage at list price.

Northflank · 2026-10-30 · major

Northflank breach — stolen customer secrets used to run up AI API bills

Northflank tells every customer to assume their environment variables were decrypted and to rotate all secrets. Users report that AI API keys stored on the platform were used without permission. Wiz lists it as the ninth such platform breach in October.

Wiz threat update banner for its Black October report on attacks against AI developer platforms

A cloud hosting platform tells all customers to rotate every secret after stored AI API keys were used by attackers.

Quick facts

Disclosed	October 30, 2026 (13:40 UTC)
Detected by	A Wiz threat alert at 11:43 UTC
Data at risk	All environment variables, assume decrypted
Confirmed abuse	Users report unauthorized use of stored AI API keys
New for all users	Audit logs, plus secret rotation for Postgres, MongoDB, MySQL and Redis
Campaign	Ninth AI developer platform breach in October, per Wiz

What is it?

Northflank, a cloud platform for deploying apps and databases, opened a security incident on October 30, 2026 after a Wiz threat alert. It tells all users to assume their environment variables were decrypted. Later that day, users reported that AI API keys they had stored on Northflank were being used without permission.

How does it work?

Attackers in this campaign go after the place where hosting platforms keep customer environment variables, because developers store model provider keys there. Wiz says the stolen keys are checked, resold, and then used in floods of model calls. Northflank patched its network policy within an hour of the alert, asked Wiz's incident team for help, and turned on secret rotation for its database addons and audit logs for every customer.

Why does it matter?

Wiz counts at least nine AI developer platforms breached in October, so a stolen key is now a direct bill, not a theoretical risk. Teams on Northflank need to revoke and replace every AI provider key and check usage dashboards now. For everyone else, it is a reason to put spend limits on model keys and avoid long-lived keys in hosting platforms.

Who is it for?

teams hosting apps on Northflank

Frequently asked questions

Which secrets should I rotate after the Northflank breach?: Northflank asks users to rotate all secrets and credentials stored on its platform, including those on workloads, in secret groups and in global secrets. Users should also revoke AI provider keys with the issuing provider, create replacements, update the affected workloads, and disable public access to addons where it is enabled.
How do I check whether my AI API keys from Northflank were abused?: Northflank tells users to review their AI provider usage and billing logs for unexpected activity, and to report suspicious usage both to Northflank support and to the provider. Northflank also turned on audit logs for every customer, including free users, on October 31, so teams can review account activity.
Is the Northflank breach part of a wider attack on AI platforms?: Northflank says the reports may fit a broader pattern of attacks on AI credentials and points to Wiz's "Black October" report, which contains similar IP addresses. Wiz counts at least nine AI developer platforms that disclosed incidents in October 2026, including Fireworks AI, OpenCode, Railway, Warp and Northflank.
How much damage can stolen AI API keys cause?: Wiz's Black October report describes two stolen enterprise keys it watched. One made about 800,000 Amazon Bedrock calls over roughly thirty hours, and the other about 1.7 million calls over thirteen hours. Wiz estimates the two cases alone likely ran up over $100,000 in usage at list price.

Try it

Revoke every AI provider key stored in Northflank, issue new ones, then check provider billing logs