Northflank Suffers Security Breach, Urges Customers to Rotate Keys

⏱️ Reading time: 9 min

Northflank told all its customers something no cloud provider wants to admit in public: assume your keys were stolen. The Northflank breach, confirmed on October 30, 2026, forced the platform to demand the immediate rotation of every environment variable, every secret, and every credential stored on its infrastructure.

📑 En este artículo

1. TL;DR
2. What Northflank Is
3. What Happened
4. Context and History
5. Technical Details: The Mechanism Behind the Northflank Breach
6. Impact and Analysis
7. What’s Next
8. Frequently Asked Questions
   1. What is Northflank and what is it used for?
   2. What kind of data was exposed in Northflank’s cybersecurity incident?
   3. How do you rotate the keys affected by the Northflank credential leak?
   4. Did Northflank confirm who attacked the cloud deployment platform?
   5. Which Northflank components remained down after the PaaS provider’s discovery?
   6. Should I be worried if I use Postgres or MongoDB addons on Northflank?
9. References

The notice came in four consecutive updates to the company’s status page, with one detail that makes everything worse: several users already confirmed their AI API keys were used by third parties.

TL;DR

• Northflank confirms breach on October 30, 2026: rotate all your environment variables and credentials now.
• Wiz flagged the access at 11:43 UTC; Northflank patched its network at 12:02 and 12:50 UTC.
• Several customers confirm their AI API keys were already used by attackers.
• Networking, certificates, services, addons, jobs, builds, and logs all went into major outage at the same time.
• The platform activated automatic secret rotation on Postgres and MongoDB addons.

What Northflank Is

Northflank is a platform as a service (PaaS) that lets teams deploy applications, databases, and jobs in containers on its own cloud or a third party’s, without the development team having to manage Kubernetes by hand. The Northflank breach on October 30 hit exactly that shared infrastructure layer.

Startups, internal teams at mid-size companies, and independent developers use Northflank to deploy APIs, workers, and managed databases (Postgres, MongoDB, Redis) without paying AWS or GCP prices directly or maintaining their own cluster.

What Happened

It all started with an automated alert. At 11:43 UTC on October 30, cloud security firm Wiz flagged anomalous activity on Northflank’s infrastructure. One minute later, at 11:44 UTC, the platform’s engineers were already reviewing the alert, according to the public incident log.

The technical response was fast, but not fast enough to contain the access. Northflank applied a first network policy patch at 12:02 UTC, another at 12:50 UTC, and two more at 13:05 UTC. At 13:00 UTC it asked Wiz’s incident response team (CIRT) for support, a sign that the scope exceeded what its own team could contain alone.

sequenceDiagram
participant W as Wiz
participant N as Northflank
participant C as Customers
W->>N: threat alert (11:43 UTC)
N->>N: network patches (12:02 and 12:50 UTC)
N->>W: requests CIRT support (13:00 UTC)
N->>C: notice to rotate environment variables (13:40 UTC)
Note over N,C: forced rotation on Postgres and MongoDB (15:12 UTC)

At 13:40 UTC, Northflank published its first public instruction: rotate your environment variables immediately. Eighteen minutes later, at 13:58 UTC, it raised the alarm level: everyone had to assume all environment variables were decrypted and disable or rotate every key. The recommendation went from caution to mandate in under half an hour.

The 15:12 UTC update confirmed the worst. Northflank activated forced secret rotation on the Postgres and MongoDB addons for all users, with no opt-out, and recommended disabling public access to those addons. The same note revealed that several customers had already confirmed misuse of their AI provider API keys, suggesting the attacker didn’t just copy data, but used it too.

At 19:28 UTC, seven hours and 45 minutes after the initial alert, the investigation remained open. Northflank repeated the instruction to assume all environment variables were compromised, extended the warning to secret groups and global secrets, and asked customers to disable public access to addons wherever it was enabled. At that point, no root cause had been confirmed publicly.

Context and History

Northflank competes in the segment of platforms promising to simplify what Kubernetes makes complicated: deploying containers, managed databases, and scheduled jobs behind a single interface and a single API. Railway, Render, and Fly.io attack the same problem from different angles, but all three carry the same design dilemma: to manage secrets for thousands of accounts, at some point in the system those secrets have to exist in plain text, even if only for microseconds.

That dilemma is neither new nor unique to Northflank. Throughout 2026, both Railway and Vercel went through their own security incidents that ended with the same advice: rotate credentials. The difference here is the scale of the response: Northflank didn’t limit the warning to one specific component, it asked customers to assume every environment variable on the platform was compromised, with no exception for plan or region.

Technical Details: The Mechanism Behind the Northflank Breach

The question customers keep repeating is why Northflank didn’t publish a narrow list of affected accounts. The answer has to do with how secret storage works on a multi-tenant platform: each service’s environment variables are stored encrypted in a shared database, but they get decrypted in memory every time a workload starts or rebuilds. If an attacker compromises the layer that does that decryption, in theory they can see any secret that passes through it, not just one account’s.

That explains the jump in tone between 13:40 UTC (\”rotate just in case\”) and 13:58 UTC (\”assume it’s already decrypted\”). At that point, Northflank had no way to narrow the blast radius to a subset of users: Wiz’s alert pointed to the network and policy layer shared by every workload, according to the status page’s own report, not an isolated service.

There’s no direct way to verify from the outside whether a specific account was accessed: Northflank didn’t publish per-customer access logs or a self-diagnosis tool on its dashboard. The only signal available to a user is comparing the creation date of their current keys against October 30, 2026; if they weren’t rotated after that date, they should be assumed exposed.

⚠️ Heads up: Northflank’s recommendation covers three distinct layers: workload secrets, secret groups, and global secrets. Rotating only the first leaves the other two exposed.

Impact and Analysis

The outage wasn’t cosmetic. Seven of the eleven components listed on Northflank’s status board (networking, certificates, services, addons, jobs, builds, and logs) fell into major outage at the same time. Only the web dashboard, the public API, the marketing site, and the documentation stayed operational, which let Northflank keep communicating about the incident while the rest of the platform was, in practice, unusable for deploying anything new.

The Northflank breach hit exactly where it hurts most for a deployment platform: if Builds and Services are down, a customer can’t even ship an emergency fix. And if Logs and Metrics also fails, that same customer is left blind to what’s happening with their own application too.

According to its own 90-day history, the platform maintains 99.65% aggregate uptime. An incident of this magnitude can eat up a good chunk of that margin: seven components in major outage for several hours represent, in practice, a significant availability drop for customers active that day.

What’s Next

As of the 19:28 UTC update, Northflank hadn’t published a confirmed root cause. The company said \”the investigation remains ongoing\” and that it had \”no additional confirmed findings to share at this time,\” the usual phrasing before a full technical post-mortem.

What is clear is the to-do list for any Northflank customer: rotate workload secrets, secret groups, and global secrets; disable public access on addons wherever it’s enabled; and check whether any AI provider key was used from an IP they don’t recognize. Several users have already confirmed, on the status channel itself, charges or misuse of those keys.

Try it yourself: log into the Northflank dashboard today, open Secret Groups and Global Secrets, and rotate any key you haven’t touched since before October 30, 2026.

Frequently Asked Questions

What is Northflank and what is it used for?

Northflank is a platform as a service that lets teams deploy applications, managed databases, and jobs in containers, built for teams that don’t want to operate Kubernetes directly.

What kind of data was exposed in Northflank’s cybersecurity incident?

The company itself asked customers to assume all environment variables were compromised: database credentials, external API tokens, and AI provider keys stored in workloads, secret groups, and global secrets.

How do you rotate the keys affected by the Northflank credential leak?

From the Northflank dashboard, in each workload’s secrets section, in Secret Groups, and in Global Secrets; customers should also disable public access on addons wherever it’s enabled.

Did Northflank confirm who attacked the cloud deployment platform?

No. As of the 19:28 UTC update on October 30, 2026, the company only confirmed the investigation remained open, without attributing the attack to any group or publishing a root cause.

Which Northflank components remained down after the PaaS provider’s discovery?

Networking, certificates, services, addons, jobs, and builds and logs and metrics all went into major outage at the same time, while the web dashboard, public API, marketing site, and documentation remained operational.

Should I be worried if I use Postgres or MongoDB addons on Northflank?

Yes: Northflank forced secret rotation on those addons for all users and explicitly recommended disabling public access wherever it was enabled.

References

• Northflank Status: official status page with the complete incident log, its updates, and the affected components.
• Northflank: official site of the platform-as-a-service affected by the breach.
• Wiz: the cloud security firm whose alert triggered Northflank’s response to the incident.
• Platform as a Service (Wikipedia): general context on the PaaS model Northflank operates under.

📱 Enjoy this content? Follow @programacion on Telegram for daily tech content in Spanish: quick summaries, fresh content every day.

Featured image: Foto de Albert Stoynov en Unsplash