rewindex

ChangesNorthflankSecurity incident

Northflank: Incident updated: Security incident

Incident updateDownplayed?Normal progress (rule, 100%)Changed status.northflank.com (opens in new tab)
Summary

Summary pending. The diff below shows exactly what changed.

Downplayed?

Vendor rated this unknown; a Hacker News thread about it drew 477 points and 361 comments. Northflank Breached (opens in new tab)

This is an automated signal, not a finding. It compares the vendor’s own impact rating with public Hacker News activity (points, comments in the first hour, distinct commenters, first-hand symptom reports). HN users skew technical, so the impact on any one customer may differ. How this is computed.

Discussed on Hacker News

Threads are matched automatically by vendor name and timing; points and comments refresh every 30 minutes. Method and limits.

Incident page: the full timeline of updates

What changed

Struck in red is what Northflank removed; blue is what they added. Muted text is unchanged context.

AddedUpdatemonitoring#1
Before: not present
After: The platform has remained operational and customer workloads have remained online throughout the incident. At this time, we have found no evidence that customer workloads or workload data were accessed. The first known decryption of secrets occurred between 02:39 UTC and 03:08 UTC on 30 October. Northflank received its first security platform alert at 11:43 UTC, and our engineers responded within minutes. The exploit was patched within 60 minutes of notification, and customers were notified within two hours. Intermittent platform degradation occurred during a high volume of simultaneous customer redeployments and during our subsequent key rotation and platform hardening work. We have worked with upstream providers to revoke credentials where possible. **For users** Please rotate all integration and project secrets if you have not already done so, review provider logs for unusual activity, and enable IP restrictions and budget limits wherever available. **For upstream providers** We strongly recommend providing API endpoints for credential revocation, IP restrictions, and enforceable budget limits. These controls enable faster incident response and help limit the impact of compromised credentials. Our investigation and independent forensic review remain ongoing. We will share further confirmed findings and a root cause analysis once available..

Compared with the previous archived version of this incident (10 to 30-minute polling). View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

History of this incident

Friday, November 6

1 incident change

Monday, November 2

1 rewrite, 1 incident change

Saturday, October 31

4 incident changes

Friday, October 30

1 rewrite, 4 incident changes

Cite this

Incident updated: Security incident on Northflank’s status page, changed 2026-11-06 10:13 UTC (change 12 of 12).

Title
Incident updated: Security incident
Vendor
Northflank
Date
URL
https://rewindex.com/change/r4c3622b1ead1bd

All Northflank changesNorthflank profileMarkdownJSON