Northflank tells customers to assume every environment variable was decrypted and rotate now

Northflank, a platform-as-a-service for deploying apps, jobs and databases, declared a security incident on 30 October with a major outage across seven platform components. Its advice to customers is blunt: “Assume all environment variables have been decrypted. Disable/rotate all keys.”

What Northflank has said so far

All times UTC, from the status page (add two hours for Israel time):

• 11:43: a Wiz threat alert fires; engineers review it a minute later.
• 12:02 to 13:05: a network policy patch, then further patches. Wiz’s incident response team is called in at 13:00.
• 13:40: “Rotate environment variables immediately.”
• 13:58: assume all environment variables were decrypted.
• 15:12: secret rotation for Postgres and MongoDB addons is enabled for all users, and Northflank recommends turning off public exposure on addons. It says rotation covers secrets on workloads, secret groups and global secrets, and that “multiple users are confirming that their AI keys have been used.”

Northflank has not said how the attacker got in or how many customers are affected. As of our check around 21:20 Israel time, there was no update after 15:12 UTC. Sentry, a Northflank customer, said it began rotating secrets before the public advice and found no unusual access to its small footprint there.

What to do

1. From a machine you trust, rotate every secret stored in Northflank, AI provider keys first, then cloud, database, payment and Git tokens.
2. Rotate addon database credentials with the new rotation feature, and switch off public exposure on addons unless you need it.
3. Check provider dashboards for usage spikes, and set spending caps on AI accounts.

Why this matters

This is the third hosting or data platform this month to tell customers their stored secrets may be exposed, after Railway’s breach aimed at AI inference keys and PingCAP’s TiDB Cloud incident. AI keys are now a prime target because they turn straight into stolen compute billed to you. Keeping them in a dedicated secrets manager with tight spending limits makes a leak cheaper and much faster to recover from.