# Northflank: Incident updated: Security incident > Incident updated: Security incident. Detected 2026-11-06 by Rewindex: what changed on Northflank’s status page, with the before/after diff. Canonical: https://rewindex.com/change/r4c3622b1ead1bd Last updated: 2026-11-06T10:13:17Z **Summary:** _summary pending_ - Kind: Incident update · Label: Normal progress (rule) - Changed: 2026-11-06 10:13 UTC · Detected: 2026-11-06 10:13 UTC - [Source: https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp](https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp) - [Company: Northflank](https://rewindex.com/company/northflank.md) - Versions: before incident\_version:750/cmvv0rn5a092f14rutwccodpp@05cfb0316069 → after incident\_version:750/cmvv0rn5a092f14rutwccodpp@c84fea50e0da - Change 12 of 12 for this incident ## Downplayed? Vendor rated this unknown; a Hacker News thread about it drew 477 points and 361 comments. [Northflank Breached](https://news.ycombinator.com/item?id=50305025) _This is an automated signal, not a finding. It compares the vendor’s own impact rating with public Hacker News activity (points, comments in the first hour, distinct commenters, first-hand symptom reports). HN users skew technical, so the impact on any one customer may differ. Method: [About: Hacker News signals](https://rewindex.com/about#signals)_ ## Discussed on Hacker News - [Northflank Breached](https://news.ycombinator.com/item?id=50305025): 477 points, 361 comments, posted 2026-10-30 15:10 UTC, posted 90 min after the vendor’s first update - [Northflank PaaS: Security Incident - Disable/rotate all keys](https://news.ycombinator.com/item?id=50304345): 3 points, 1 comments, posted 2026-10-30 14:21 UTC, posted 42 min after the vendor’s first update Incident page (full timeline): [Security incident](https://rewindex.com/company/northflank/incidents/cmvv0rn5a092f14rutwccodpp.md) ## What changed **1. Added: Update** (monitoring) · 2026-11-06 10:09 UTC ```diff + The platform has remained operational and customer workloads have remained online throughout the incident. At this time, we have found no evidence that customer workloads or workload data were accessed. The first known decryption of secrets occurred between 02:39 UTC and 03:08 UTC on 30 October. Northflank received its first security platform alert at 11:43 UTC, and our engineers responded within minutes. The exploit was patched within 60 minutes of notification, and customers were notified within two hours. Intermittent platform degradation occurred during a high volume of simultaneous customer redeployments and during our subsequent key rotation and platform hardening work. We have worked with upstream providers to revoke credentials where possible. **For users** Please rotate all integration and project secrets if you have not already done so, review provider logs for unusual activity, and enable IP restrictions and budget limits wherever available. **For upstream providers** We strongly recommend providing API endpoints for credential revocation, IP restrictions, and enforceable budget limits. These controls enable faster incident response and help limit the impact of compromised credentials. Our investigation and independent forensic review remain ongoing. We will share further confirmed findings and a root cause analysis once available.. ``` ## History of this incident | When (UTC) | Change | Label | | --- | --- | --- | | 2026-10-30 14:03 UTC | [Incident updated: Security incident](https://rewindex.com/change/r9b6e9862177929.md) | Normal progress | | 2026-10-30 15:13 UTC | [Incident updated: Security incident](https://rewindex.com/change/rfd65152a228e26.md) | Normal progress | | 2026-10-30 16:13 UTC | [Incident silently edited: Security incident](https://rewindex.com/change/rd4800fe5a06b2c.md) | Normal progress | | 2026-10-30 19:33 UTC | [Incident updated: Security incident](https://rewindex.com/change/r92ee737780c9ce.md) | Normal progress | | 2026-10-30 23:43 UTC | [Incident updated: Security incident](https://rewindex.com/change/r4eacee8745e06c.md) | Normal progress | | 2026-10-31 01:13 UTC | [Incident updated: Security incident](https://rewindex.com/change/r09ce4695b191fd.md) | Normal progress | | 2026-10-31 13:43 UTC | [Incident updated: Security incident](https://rewindex.com/change/r20a4be3fe3ed65.md) | Normal progress | | 2026-10-31 22:33 UTC | [Incident updated: Security incident](https://rewindex.com/change/r8d4881757c73cf.md) | Normal progress | | 2026-10-31 23:33 UTC | [Incident updated: Security incident](https://rewindex.com/change/redfb273299b334.md) | Normal progress | | 2026-11-02 11:13 UTC | [Incident updated: Security incident](https://rewindex.com/change/r00a9beed4458d7.md) | Normal progress | | 2026-11-02 11:43 UTC | [Incident silently edited: Security incident](https://rewindex.com/change/rebd97a09b8d0c9.md) | Wording only | | 2026-11-06 10:13 UTC | Incident updated: Security incident (this change) | Normal progress | Previous: [change](https://rewindex.com/change/rebd97a09b8d0c9.md) · All Northflank changes: [timeline](https://rewindex.com/company/northflank/changes.md) _Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._ ## Cite this Incident updated: Security incident on Northflank’s status page, changed 2026-11-06 10:13 UTC (change 12 of 12). - Canonical URL: https://rewindex.com/change/r4c3622b1ead1bd - Citation: Northflank, “Incident updated: Security incident” (2026-11-06 10:13 UTC). Archived by Rewindex: https://rewindex.com/change/r4c3622b1ead1bd (CC BY 4.0). - Markdown link: `[Northflank: Incident updated: Security incident (2026-11-06)](https://rewindex.com/change/r4c3622b1ead1bd)` --- Canonical: https://rewindex.com/change/r4c3622b1ead1bd · Markdown: https://rewindex.com/change/r4c3622b1ead1bd.md · JSON: https://rewindex.com/api/v1/changes/r4c3622b1ead1bd · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-11T04:21:51.451Z