Northflank says to rotate everything: what its breach notice confirms, and what customers should check now

Northflank’s latest status updates do not read like a tidy postmortem. They read like an active incident response playbook: rotate secrets immediately, assume environment variables were decrypted, disable public access to addons, and treat customer AI keys as potentially abused.

That is the practical takeaway for teams using a hosted platform control plane. Northflank has confirmed a security incident and major outage, but it has not yet published a full forensic accounting of scope. What it has said, in public, is enough to justify immediate customer-side checks on secrets, credentials, addon exposure, and AI-provider billing logs. The company’s own status page is the primary source here, and it shows the guidance tightening as new reports came in on October 30 and 31, 2026. Northflank status page

What Northflank has confirmed so far

Northflank’s status page says the incident was “Identified · Major outage” and gives a timeline of updates. The first public guidance on October 30 at 1:40 PM UTC told users to rotate environment variables immediately. At 1:58 PM UTC, Northflank escalated that advice: “Assume all environment variables have been decrypted. Disable/rotate all keys.” Later updates expanded the scope of the warning to secrets stored in workloads, secret groups and global secrets, and told customers to disable public access to addons where enabled. Northflank status page

The most consequential confirmation is not that a secret store exists, but that Northflank believes its platform control plane may have exposed decrypted customer secrets. In the company’s own words, users should assume all environment variables were decrypted and rotate all secrets and credentials immediately. That is the sort of statement platform teams should treat as a whole-system credential event, not a narrow app bug. Northflank status page

The status page also says:

• Secret rotation on Postgres and MongoDB has been enabled for all users.
• Audit logs were enabled for all customers, including free users.
• Users have reported unauthorised use of AI API keys supplied to the Northflank platform.
• Northflank says its investigation is ongoing and that it has “no further confirmed findings to share at this time.” Northflank status page

That last line matters. It means the company is not yet claiming a final root cause, a final list of affected tenants, or a final determination about every data class that may or may not have been exposed. For customers, the disclosure is actionable, but still incomplete. Northflank status page

The sequence Northflank published

The incident timeline on the status page shows a compressed response on October 30:

• 11:43 UTC: Wiz threat alert
• 11:44 UTC: Northflank engineers review the alert
• 12:02 UTC: Initial network policy patch
• 12:50 UTC: Additional patching deployed
• 13:00 UTC: Wiz CIRT support requested
• 13:05 UTC: Additional patching deployed

Northflank then posted successive customer warnings later in the day, moving from rotating environment variables to assuming decrypted secrets and then to broader rotation plus addon hardening. By 1:04 AM UTC on October 31, the company said audit logs had been enabled for all customers. Northflank status page

That progression suggests the incident is still being scoped rather than finalized. The company has already acted on containment and visibility, but the public record still stops short of saying exactly which customer projects were accessed, for how long, or whether every secret category was definitely touched. Northflank status page

What the control-plane risk means in practice

A hosted platform is not just compute. It is also the management plane that stores deployment credentials, environment variables, registry credentials, API keys, and sometimes database connection strings. If that plane is compromised, the downstream blast radius is often larger than a single runtime cluster because the attacker can reuse the platform’s own trusted secrets elsewhere.

Northflank’s own warning reflects that logic: rotate anything stored in the platform, not just production runtime secrets. The fact that users reported unauthorized AI API usage is a concrete reminder that these keys are often expensive and immediately exploitable. Unlike a password reset page, there is no grace period when an AI key is exposed; billing impact can begin as soon as the key is used. Northflank status page

What customers should do now

Northflank’s guidance points to a specific checklist. For teams that used the platform for deployments, builds, secrets, or managed addons, the immediate response should be:

1. Rotate every secret stored in Northflank.
2. User-provided environment variables
3. Workload secrets
4. Secret groups
5. Global secrets
6. Registry tokens, OAuth client secrets, webhook secrets, and third-party API keys if they were stored there
7. Revoke and replace credentials with their issuing providers.
8. Cloud provider access keys
9. Git provider tokens
10. AI provider keys
11. Database credentials
12. Any service account or machine identity used by workloads
13. Review usage and billing logs.
14. Check AI provider dashboards for unusual model calls or spend spikes
15. Check cloud and SaaS logs for new sessions, token use, or API requests after the incident window
16. Audit exposed services and addons.
17. Disable public access on addons if it was enabled
18. Review Postgres and MongoDB exposure and rotate database credentials
19. Confirm no environment variable or secret was reused across environments without replacement
20. Turn on and export logs now.
21. Northflank says audit logs are enabled for all customers, so teams should preserve them before retention windows close
22. Save evidence of unexpected key use or access for incident response and vendor follow-up

The operational lesson is simple: if a platform control plane may have exposed decrypted secrets, treat every dependent integration as compromised until proven otherwise.

What remains unconfirmed

Northflank has not publicly confirmed several points that security teams will want answered before they can close the loop:

• whether the incident involved only management-plane data or also runtime environments
• whether customer source code, container images, or build artifacts were exposed
• whether the exposure was limited to environment variables and stored secrets or included other account metadata
• how many customers were affected
• whether the attack path is fully contained

The company says the investigation is ongoing and that there are no further confirmed findings yet. That is the right place to stop certainty for now. But it is not a reason to wait on rotation; Northflank’s own guidance is already explicit that customers should act as if stored secrets were exposed. Northflank status page

Why this incident matters beyond Northflank

The immediate story is about one platform, but the broader lesson is for any team outsourcing the control plane for builds and deployments. Hosted platforms compress convenience and risk into the same interface. If the management plane goes wrong, the compromise can spread across every workload, secret store, and third-party integration the platform touches.

Northflank’s disclosure also shows how incident messaging has shifted: the company did not wait for a polished technical explanation before telling customers to rotate. It published the operational guidance first, then updated the status page as new information arrived. For customers, that is the right signal to prioritize response over speculation.

For now, the clearest evidence says this: Northflank believes customer secrets may have been decrypted, some users have already reported AI key misuse, and the company has enabled audit logs while telling customers to rotate broadly and immediately. That is enough to justify a same-day security review in any environment that relied on the platform’s secret store or addon exposure settings. Northflank status page