rewindex

ChangesNorthflankSecurity incident

Northflank: Incident updated: Security incident

Incident updateDownplayed?Not classified yetChanged status.northflank.com (opens in new tab)
Summary

Summary pending. The diff below shows exactly what changed.

Downplayed?

Vendor rated this unknown; a Hacker News thread about it drew 411 points and 305 comments. Northflank Breached (opens in new tab)

This is an automated signal, not a finding. It compares the vendor’s own impact rating with public Hacker News activity (points, comments in the first hour, distinct commenters, first-hand symptom reports). HN users skew technical, so the impact on any one customer may differ. How this is computed.

Discussed on Hacker News

Threads are matched automatically by vendor name and timing; points and comments refresh every 30 minutes. Method and limits.

Incident page: the full timeline of updates

What changed

Struck in red is what Northflank removed; blue is what they added. Muted text is unchanged context.

AddedUpdateidentified#1
Before: not present
After: Users have reported unauthorised use of AI API keys supplied to the Northflank platform. If you have not already rotated your user-provided secrets stored in Northflank, please do so immediately. Revoke existing credentials with their issuing providers, generate replacements, and update the affected secrets and workloads in Northflank. Review your AI provider usage and billing logs for unexpected activity, and report any suspicious usage to Northflank support and the relevant provider. These reports may be consistent with the broader pattern of attacks targeting AI credentials. Similar IP addresses are contained in this article [Wiz’s “Black October” report](https://www.wiz.io/blog/black-october-for-ai-developer-platforms)..

Compared with the previous archived version of this incident (10 to 30-minute polling). View the live incident (opens in new tab).

Archive proof

Rewindex commits each version of an incident it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.

How the archive is checked, and what it cannot prove.

History of this incident

TodaySaturday, October 31Sat, Oct 31

1 incident change

YesterdayFriday, October 30Fri, Oct 30

1 rewrite, 4 incident changes

All Northflank changesNorthflank profileMarkdownJSON