rewindex

ChangesNorthflankSecurity incident

Northflank: Incident updated: Security incident

Incident updateDownplayed?Not classified yetChanged status.northflank.com (opens in new tab)
Summary

Summary pending. The diff below shows exactly what changed.

Downplayed?

Vendor rated this unknown; a Hacker News thread about it drew 477 points and 361 comments. Northflank Breached (opens in new tab)

This is an automated signal, not a finding. It compares the vendor’s own impact rating with public Hacker News activity (points, comments in the first hour, distinct commenters, first-hand symptom reports). HN users skew technical, so the impact on any one customer may differ. How this is computed.

Discussed on Hacker News

Threads are matched automatically by vendor name and timing; points and comments refresh every 30 minutes. Method and limits.

Incident page: the full timeline of updates

What changed

Struck in red is what Northflank removed; blue is what they added. Muted text is unchanged context.

ChangedStatus#1
Before: identified
After: monitoring
AddedUpdatemonitoring#2
Before: not present
After: We believe the attack vector was contained within an hour of the first alert. Our investigation shows no sign that the attacker was in our environment after the attack. Independent forensic auditors began reviewing the attack together with Northflank over the weekend, and they continue to review it. Impact on your workloads Running workloads were unaffected. At this time we have seen no sign that workloads or workload data were accessed during the attack. Evidence suggests it was focused on secrets held in our control plane. Customers on forward-deployed or dedicated control planes are unaffected. We have patched CVE-2026-98432 across our fleet, including BYOC clusters where we have an active integration. If your BYOC cluster is no longer connected to Northflank, please contact support. Over the last few days there has been intermittent platform degradation while we rotated our own keys and hardened the platform. What you need to do Some customers have reported unauthorised use of AI secrets. Please rotate all secrets now, both integration secrets and project secrets, even if you haven’t seen suspicious activity. We recommend starting with AI provider keys, cloud provider credentials, payment provider keys, private keys, and database and other service credentials. We also recommend reviewing your provider logs for unusual activity. If you have seen unexpected AI usage or spend, contact your AI providers directly, such as OpenAI and Anthropic. Where we were able to act on your behalf, we have revoked Northflank access tokens and sessions, VCS integrations, and cross-account IAM roles and service accounts. If you haven’t already, sign in again and reconnect your integrations. Need help? If you need help rotating secrets or checking that everything has been rotated, contact [support@northflank.com](mailto:support@northflank.com), or use your direct channel with us if you have one. We are treating this with the utmost urgency, and the entire organisation has been working 24/7. What’s next We will keep updating this page as the review progresses, and we intend to share a root cause analysis once we have confirmed findings..

Compared with the previous archived version of this incident (10 to 30-minute polling). View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves this record existed by then and has not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

Rewindex captured a newer version after the last checkpoint; the next run () commits it.

History of this incident

TodayMonday, November 2Mon, Nov 2

1 rewrite, 1 incident change

Saturday, October 31

4 incident changes

Friday, October 30

1 rewrite, 4 incident changes

All Northflank changesNorthflank profileMarkdownJSON