# Northflank: Incident updated: Security incident

> Incident updated: Security incident. Detected 2026-11-02 by Rewindex: what changed on Northflank’s status page, with the before/after diff.

Canonical: https://rewindex.com/change/r00a9beed4458d7
Last updated: 2026-11-02T11:13:02Z

**Summary:** _summary pending_
- Kind: Incident update · Label: not classified yet
- Changed: 2026-11-02 11:13 UTC · Detected: 2026-11-02 11:13 UTC
- [Source: https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp](https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp)
- [Company: Northflank](https://rewindex.com/company/northflank.md)
- Versions: before incident\_version:750/cmvv0rn5a092f14rutwccodpp@cabfaa2038b4 → after incident\_version:750/cmvv0rn5a092f14rutwccodpp@37a1e1c81368
- Change 10 of 11 for this incident

## Downplayed?

Vendor rated this unknown; a Hacker News thread about it drew 477 points and 361 comments. [Northflank Breached](https://news.ycombinator.com/item?id=50305025)

_This is an automated signal, not a finding. It compares the vendor’s own impact rating with public Hacker News activity (points, comments in the first hour, distinct commenters, first-hand symptom reports). HN users skew technical, so the impact on any one customer may differ. Method: [About: Hacker News signals](https://rewindex.com/about#signals)_
## Discussed on Hacker News

- [Northflank Breached](https://news.ycombinator.com/item?id=50305025): 477 points, 361 comments, posted 2026-10-30 15:10 UTC, posted 90 min after the vendor’s first update
- [Northflank PaaS: Security Incident - Disable/rotate all keys](https://news.ycombinator.com/item?id=50304345): 3 points, 1 comments, posted 2026-10-30 14:21 UTC, posted 42 min after the vendor’s first update

Incident page (full timeline): [Security incident](https://rewindex.com/company/northflank/incidents/cmvv0rn5a092f14rutwccodpp.md)
## What changed

**1. Changed: Status**

```diff
- identified
+ monitoring
```

**2. Added: Update** (monitoring) · 2026-11-02 11:09 UTC

```diff
+ We believe the attack vector was contained within an hour of the first alert. Our investigation shows no sign that the attacker was in our environment after the attack. Independent forensic auditors began reviewing the attack together with Northflank over the weekend, and they continue to review it. Impact on your workloads Running workloads were unaffected. At this time we have seen no sign that workloads or workload data were accessed during the attack. Evidence suggests it was focused on secrets held in our control plane. Customers on forward-deployed or dedicated control planes are unaffected. We have patched CVE-2026-98432 across our fleet, including BYOC clusters where we have an active integration. If your BYOC cluster is no longer connected to Northflank, please contact support. Over the last few days there has been intermittent platform degradation while we rotated our own keys and hardened the platform. What you need to do Some customers have reported unauthorised use of AI secrets. Please rotate all secrets now, both integration secrets and project secrets, even if you haven’t seen suspicious activity. We recommend starting with AI provider keys, cloud provider credentials, payment provider keys, private keys, and database and other service credentials. We also recommend reviewing your provider logs for unusual activity. If you have seen unexpected AI usage or spend, contact your AI providers directly, such as OpenAI and Anthropic. Where we were able to act on your behalf, we have revoked Northflank access tokens and sessions, VCS integrations, and cross-account IAM roles and service accounts. If you haven’t already, sign in again and reconnect your integrations. Need help? If you need help rotating secrets or checking that everything has been rotated, contact [support@northflank.com](mailto:support@northflank.com), or use your direct channel with us if you have one. We are treating this with the utmost urgency, and the entire organisation has been working 24/7. What’s next We will keep updating this page as the review progresses, and we intend to share a root cause analysis once we have confirmed findings..
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-30 14:03 UTC | [Incident updated: Security incident](https://rewindex.com/change/r9b6e9862177929.md) | Normal progress |
| 2026-10-30 15:13 UTC | [Incident updated: Security incident](https://rewindex.com/change/rfd65152a228e26.md) | Normal progress |
| 2026-10-30 16:13 UTC | [Incident silently edited: Security incident](https://rewindex.com/change/rd4800fe5a06b2c.md) | Normal progress |
| 2026-10-30 19:33 UTC | [Incident updated: Security incident](https://rewindex.com/change/r92ee737780c9ce.md) | Normal progress |
| 2026-10-30 23:43 UTC | [Incident updated: Security incident](https://rewindex.com/change/r4eacee8745e06c.md) | Normal progress |
| 2026-10-31 01:13 UTC | [Incident updated: Security incident](https://rewindex.com/change/r09ce4695b191fd.md) | Normal progress |
| 2026-10-31 13:43 UTC | [Incident updated: Security incident](https://rewindex.com/change/r20a4be3fe3ed65.md) | Normal progress |
| 2026-10-31 22:33 UTC | [Incident updated: Security incident](https://rewindex.com/change/r8d4881757c73cf.md) | Normal progress |
| 2026-10-31 23:33 UTC | [Incident updated: Security incident](https://rewindex.com/change/redfb273299b334.md) | Normal progress |
| 2026-11-02 11:13 UTC | Incident updated: Security incident (this change) |  |
| 2026-11-02 11:43 UTC | [Incident silently edited: Security incident](https://rewindex.com/change/rebd97a09b8d0c9.md) |  |

Previous: [change](https://rewindex.com/change/redfb273299b334.md) · Next: [change](https://rewindex.com/change/rebd97a09b8d0c9.md) · All Northflank changes: [timeline](https://rewindex.com/company/northflank/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/r00a9beed4458d7 · Markdown: https://rewindex.com/change/r00a9beed4458d7.md · JSON: https://rewindex.com/api/v1/changes/r00a9beed4458d7 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-02T21:19:55.980Z