Northflank (PaaS / AI app hosting platform) breached: attackers decrypted customers' environment variables and secrets, stolen AI API keys already being used

On 2026-10-30 Northflank confirmed a security incident on its status page after a Wiz threat alert at 11:43 UTC. At 13:58 UTC it told all customers to assume every environment variable has been decrypted and to disable/rotate all keys: secrets on workloads, secret groups and global secrets. Multiple customers confirm their AI API keys have already been used by attackers. Platform components (networking, certificates, services, addons, jobs, builds, logs) were in major outage. Postgres and MongoDB addon secret rotation was enabled; Northflank recommends disabling public exposure on addons. Anyone running workloads, jobs or databases on Northflank is at risk; whether BYOC deployments are affected is unknown. Attack vector, attacker and number of affected customers unknown. Sentry, a customer, reports rotating secrets and finding no impact.

Summary written from the sources below. Check the originals before acting.