# Northflank: Incident updated: Security incident

> Incident updated: Security incident. Detected 2026-10-30 by Rewindex: what changed on Northflank’s status page, with the before/after diff.

Canonical: https://rewindex.com/change/r4eacee8745e06c
Last updated: 2026-10-30T23:43:03Z

**Summary:** _summary pending_
- Kind: Incident update · Label: Normal progress (rule)
- Changed: 2026-10-30 23:43 UTC · Detected: 2026-10-30 23:43 UTC
- [Source: https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp](https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp)
- [Company: Northflank](https://rewindex.com/company/northflank.md)
- Versions: before incident\_version:750/cmvv0rn5a092f14rutwccodpp@f66db375945d → after incident\_version:750/cmvv0rn5a092f14rutwccodpp@ccb740dc29da
- Change 5 of 6 for this incident

## Downplayed?

Vendor rated this unknown; a Hacker News thread about it drew 443 points and 316 comments. [Northflank Breached](https://news.ycombinator.com/item?id=50305025)

_This is an automated signal, not a finding. It compares the vendor’s own impact rating with public Hacker News activity (points, comments in the first hour, distinct commenters, first-hand symptom reports). HN users skew technical, so the impact on any one customer may differ. Method: [About: Hacker News signals](https://rewindex.com/about#signals)_
## Discussed on Hacker News

- [Northflank Breached](https://news.ycombinator.com/item?id=50305025): 443 points, 316 comments, posted 2026-10-30 15:10 UTC, posted 90 min after the vendor’s first update
- [Northflank PaaS: Security Incident - Disable/rotate all keys](https://news.ycombinator.com/item?id=50304345): 3 points, 1 comments, posted 2026-10-30 14:21 UTC, posted 42 min after the vendor’s first update

Incident page (full timeline): [Security incident](https://rewindex.com/company/northflank/incidents/cmvv0rn5a092f14rutwccodpp.md)
## What changed

**1. Added: Update** (identified) · 2026-10-30 23:38 UTC

```diff
+ Users have reported unauthorised use of AI API keys supplied to the Northflank platform. If you have not already rotated your user-provided secrets stored in Northflank, please do so immediately. Revoke existing credentials with their issuing providers, generate replacements, and update the affected secrets and workloads in Northflank. Review your AI provider usage and billing logs for unexpected activity, and report any suspicious usage to Northflank support and the relevant provider. These reports may be consistent with the broader pattern of attacks targeting AI credentials. Similar IP addresses are contained in this article [Wiz’s “Black October” report](https://www.wiz.io/blog/black-october-for-ai-developer-platforms)..
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-30 14:03 UTC | [Incident updated: Security incident](https://rewindex.com/change/r9b6e9862177929.md) | Normal progress |
| 2026-10-30 15:13 UTC | [Incident updated: Security incident](https://rewindex.com/change/rfd65152a228e26.md) | Normal progress |
| 2026-10-30 16:13 UTC | [Incident silently edited: Security incident](https://rewindex.com/change/rd4800fe5a06b2c.md) | Normal progress |
| 2026-10-30 19:33 UTC | [Incident updated: Security incident](https://rewindex.com/change/r92ee737780c9ce.md) | Normal progress |
| 2026-10-30 23:43 UTC | Incident updated: Security incident (this change) | Normal progress |
| 2026-10-31 01:13 UTC | [Incident updated: Security incident](https://rewindex.com/change/r09ce4695b191fd.md) | Normal progress |

Previous: [change](https://rewindex.com/change/r92ee737780c9ce.md) · Next: [change](https://rewindex.com/change/r09ce4695b191fd.md) · All Northflank changes: [timeline](https://rewindex.com/company/northflank/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/r4eacee8745e06c · Markdown: https://rewindex.com/change/r4eacee8745e06c.md · JSON: https://rewindex.com/api/v1/changes/r4eacee8745e06c · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-31T11:20:16.136Z