Vendor incident, severity critical
Northflank breach exposes customer environment variables; AI API keys abused
Published
Northflank disclosed a security incident on October 30, 2026 and told customers to assume all environment variables stored on the platform were decrypted and stolen. Multiple customers reported unauthorized use of AI API keys stored on Northflank. The company has not disclosed how attackers got in or how many customers were affected.
What's affected
- northflankevery version
What to do
- Rotate all secrets stored in Northflank workloads, secret groups and global secrets immediately.
- Rotate and disable AI API keys and other keys supplied to the platform.
- Review AI provider usage and billing logs for unexpected activity and report suspicious usage to Northflank and the AI provider.
- Use the new credential rotation for PostgreSQL, MongoDB, MySQL and Redis add-ons and disable public access to add-ons where enabled.
- Review the audit logs, now enabled for all accounts, for suspicious activity.
Secrets to rotate if you were affected
Environment variables, AI API keys, Database credentials, Cloud credentials, Platform tokens.
Check whether you were affected
Pharon tells teams automatically when this affects something they run. To check a machine, run this in Claude Code with the Pharon plugin, in the repository that uses it:
/pharon:check-incident northflank-breach-2026-10References
Notice northflank-breach-2026-10, signed with key feed-prod-2026-10 (Ed25519). The Pharon CLI verifies the signature before using a notice.