# Northflank: Incident updated: Security incident

> Incident updated: Security incident. Detected 2026-10-30 by Rewindex: what changed on Northflank’s status page, with the before/after diff.

Canonical: https://rewindex.com/change/r92ee737780c9ce
Last updated: 2026-10-30T19:33:14Z

**Summary:** _summary pending_
- Kind: Incident update · Label: Normal progress (rule)
- Changed: 2026-10-30 19:33 UTC · Detected: 2026-10-30 19:33 UTC
- [Source: https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp](https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp)
- [Company: Northflank](https://rewindex.com/company/northflank.md)
- Versions: before incident\_version:750/cmvv0rn5a092f14rutwccodpp@ef93a5216083 → after incident\_version:750/cmvv0rn5a092f14rutwccodpp@f66db375945d
- Change 4 of 6 for this incident

## Downplayed?

Vendor rated this unknown; a Hacker News thread about it drew 443 points and 316 comments. [Northflank Breached](https://news.ycombinator.com/item?id=50305025)

_This is an automated signal, not a finding. It compares the vendor’s own impact rating with public Hacker News activity (points, comments in the first hour, distinct commenters, first-hand symptom reports). HN users skew technical, so the impact on any one customer may differ. Method: [About: Hacker News signals](https://rewindex.com/about#signals)_
## Discussed on Hacker News

- [Northflank Breached](https://news.ycombinator.com/item?id=50305025): 443 points, 316 comments, posted 2026-10-30 15:10 UTC, posted 90 min after the vendor’s first update
- [Northflank PaaS: Security Incident - Disable/rotate all keys](https://news.ycombinator.com/item?id=50304345): 3 points, 1 comments, posted 2026-10-30 14:21 UTC, posted 42 min after the vendor’s first update

Incident page (full timeline): [Security incident](https://rewindex.com/company/northflank/incidents/cmvv0rn5a092f14rutwccodpp.md)
## What changed

**1. Added: Update** (identified) · 2026-10-30 19:28 UTC

```diff
+ Our investigation is ongoing. We have no further confirmed findings to share at this time. Our guidance remains unchanged: assume all environment variables have been compromised and rotate all secrets and credentials immediately, including those in workloads, secret groups and global secrets. Disable public access to addons where enabled. We will share further updates as more information is confirmed..
```

## History of this incident

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-30 14:03 UTC | [Incident updated: Security incident](https://rewindex.com/change/r9b6e9862177929.md) | Normal progress |
| 2026-10-30 15:13 UTC | [Incident updated: Security incident](https://rewindex.com/change/rfd65152a228e26.md) | Normal progress |
| 2026-10-30 16:13 UTC | [Incident silently edited: Security incident](https://rewindex.com/change/rd4800fe5a06b2c.md) | Normal progress |
| 2026-10-30 19:33 UTC | Incident updated: Security incident (this change) | Normal progress |
| 2026-10-30 23:43 UTC | [Incident updated: Security incident](https://rewindex.com/change/r4eacee8745e06c.md) | Normal progress |
| 2026-10-31 01:13 UTC | [Incident updated: Security incident](https://rewindex.com/change/r09ce4695b191fd.md) | Normal progress |

Previous: [change](https://rewindex.com/change/rd4800fe5a06b2c.md) · Next: [change](https://rewindex.com/change/r4eacee8745e06c.md) · All Northflank changes: [timeline](https://rewindex.com/company/northflank/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._


---
Canonical: https://rewindex.com/change/r92ee737780c9ce · Markdown: https://rewindex.com/change/r92ee737780c9ce.md · JSON: https://rewindex.com/api/v1/changes/r92ee737780c9ce · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-31T11:28:38.712Z