# Northflank: Security incident

> Northflank edited its security incident update to announce secret rotation for Postgres and MongoDB for all users and recommend disabling public expose on addons if enabled. Users are still advised to assume environment variables are decrypted and rotate secrets immediately; multiple users reported

Canonical: https://rewindex.com/company/northflank/incidents/cmvv0rn5a092f14rutwccodpp
Last updated: 2026-10-31T11:30:02Z

- Impact (vendor’s label): unknown · Downplayed?
- Status: identified · edited after publishing
- Started: 2026-10-30 13:40 UTC · Resolved: not resolved · Duration: ongoing
- Updates: 6 · Affected components: Addons, Builds, Certificates, Jobs, Logs and Metrics, Networking, Services
- [Vendor status page: https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp](https://status.northflank.com/incident/cmvv0rn5a092f14rutwccodpp)
- [Company: Northflank](https://rewindex.com/company/northflank.md)

## Summary

Northflank edited its security incident update to announce secret rotation for Postgres and MongoDB for all users and recommend disabling public expose on addons if enabled. Users are still advised to assume environment variables are decrypted and rotate secrets immediately; multiple users reported their AI keys had been used. _(machine-written, sol)_
## Downplayed?

Vendor rated this unknown; a Hacker News thread about it drew 443 points and 316 comments. [Northflank Breached](https://news.ycombinator.com/item?id=50305025)

_This is an automated signal, not a finding. It compares the vendor’s own impact rating with public Hacker News activity (points, comments in the first hour, distinct commenters, first-hand symptom reports). HN users skew technical, so the impact on any one customer may differ. Method: [About: Hacker News signals](https://rewindex.com/about#signals)_
## Discussed on Hacker News

- [Northflank Breached](https://news.ycombinator.com/item?id=50305025): 443 points, 316 comments, posted 2026-10-30 15:10 UTC, posted 90 min after the vendor’s first update
- [Northflank PaaS: Security Incident - Disable/rotate all keys](https://news.ycombinator.com/item?id=50304345): 3 points, 1 comments, posted 2026-10-30 14:21 UTC, posted 42 min after the vendor’s first update

## Timeline of updates

- **investigating** 2026-10-30 13:40 UTC: Rotate environment variables immediately. 11:43 UTC: Wiz threat alert 11:44 UTC: Northflank engineers review the alert 12:02 UTC: Initial network policy patch 12:50 UTC: Additional patching deployed 13:00 UTC: Wiz CIRT support requested 13:05 UTC: Additional patching deployed 13:05 UTC: Additional patching deployed.
- **identified** 2026-10-30 13:58 UTC: Assume all environment variables have been decrypted. Disable/rotate all keys..
- **identified** 2026-10-30 15:12 UTC _(edited after publishing)_: Secret rotation on Postgres and MongoDB has been enabled for all users. We recommend disabling public expose on addons if you have enabled that. All users should assume their environment variables are decrypted and begin rotation immediately. Secrets on workloads Secret groups Global secrets Multiple users are confirming that their AI keys have been used..
- **identified** 2026-10-30 19:28 UTC: Our investigation is ongoing. We have no further confirmed findings to share at this time. Our guidance remains unchanged: assume all environment variables have been compromised and rotate all secrets and credentials immediately, including those in workloads, secret groups and global secrets. Disable public access to addons where enabled. We will share further updates as more information is confirmed..
- **identified** 2026-10-30 23:38 UTC: Users have reported unauthorised use of AI API keys supplied to the Northflank platform. If you have not already rotated your user-provided secrets stored in Northflank, please do so immediately. Revoke existing credentials with their issuing providers, generate replacements, and update the affected secrets and workloads in Northflank. Review your AI provider usage and billing logs for unexpected activity, and report any suspicious usage to Northflank support and the relevant provider. These reports may be consistent with the broader pattern of attacks targeting AI credentials. Similar IP addresses are contained in this article Wiz’s “Black October” report (https://www.wiz.io/blog/black-october-for-ai-developer-platforms)..
- **identified** 2026-10-31 01:04 UTC: We have enabled audit logs for all customers, including free users..

## Rewindex changes for this incident

- 2026-10-30 14:03 UTC: [Incident updated: Security incident](https://rewindex.com/change/r9b6e9862177929.md)
- 2026-10-30 15:13 UTC: [Incident updated: Security incident](https://rewindex.com/change/rfd65152a228e26.md)
- 2026-10-30 16:13 UTC: [Incident silently edited: Security incident](https://rewindex.com/change/rd4800fe5a06b2c.md)
- 2026-10-30 19:33 UTC: [Incident updated: Security incident](https://rewindex.com/change/r92ee737780c9ce.md)
- 2026-10-30 23:43 UTC: [Incident updated: Security incident](https://rewindex.com/change/r4eacee8745e06c.md)
- 2026-10-31 01:13 UTC: [Incident updated: Security incident](https://rewindex.com/change/r09ce4695b191fd.md)


---
Canonical: https://rewindex.com/company/northflank/incidents/cmvv0rn5a092f14rutwccodpp · Markdown: https://rewindex.com/company/northflank/incidents/cmvv0rn5a092f14rutwccodpp.md · JSON: https://rewindex.com/api/v1/companies/northflank/incidents/cmvv0rn5a092f14rutwccodpp · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-31T11:30:02.104Z