{"id":"INC-northflank-cmn651uh000a880hcl3ox9cxf","kind":"incident","aliases":[],"related":[],"title":"Northflank: Active DDoS Attack in Europe - West - Netherlands","description":"Type: Incident\n    Duration: 3 hours and 21 minutes\n\n    Affected Components: Addons, Jobs, Services\n    Mar 25, 17:48:48 GMT+0 - Resolved - The DDoS attack has stopped we will continue to monitor the affected region. Mar 25, 16:01:00 GMT+0 - Monitoring - The region is currently stable. We are still actively mitigating the ongoing attack. Mar 25, 14:28:04 GMT+0 - Identified - We are currently experiencing a large DDoS attack in the Europe - West - Netherlands region. This is affecting public ingress into the cluster. Internal traffic is not affected. The team is working on additional mitigations.","summary":"Northflank reported a large DDoS attack on its Europe-West Netherlands region that affected public ingress into the cluster, while internal traffic was not affected. The incident was marked resolved after about 3 hours and 21 minutes, with addons, jobs and services affected.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Northflank","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["europe-west-netherlands","incident","northflank","security","vendor"],"not_affected_if":["other-regions"],"how_to_check":null,"fix":null,"status":"resolved","published_at":"2026-03-25T14:28:04+00:00","first_seen_at":"2026-11-08T16:58:28+00:00","triaged_at":"2026-11-08T17:03:23+00:00","updated_at":"2026-11-08T17:03:23+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T17:03:23Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Northflank: DDoS attack disrupted public traffic in Netherlands region","impact":"low","summary":"Northflank reported a large DDoS attack on its Europe-West Netherlands region that affected public ingress into the cluster, while internal traffic was not affected. The incident was marked resolved after about 3 hours and 21 minutes, with addons, jobs and services affected.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["northflank","europe-west-netherlands"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"public service availability disrupted during the DDoS attack","analyst_note":"","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["other-regions"],"who_is_affected":"Teams running addons, jobs or services on Northflank in the Europe-West Netherlands region were affected through their public ingress during the attack. The sources do not say what customers need to check or change; the incident is resolved and the vendor is monitoring the region.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.00068,"input_tokens":4712,"output_tokens":418,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':85C,106C,127C '00':104C '01':103C '04':125C '14':123C '16':102C '17':81C '21':58B,72C '25':80C,101C,122C '28':124C '3':55B,69C '48':82C,83C 'activ':2A,116C 'addit':161C 'addon':61B,76C 'affect':36B,47B,65B,74C,98C,145C,155C 'attack':4A,27B,89C,120C,136C 'cluster':41B,150C 'cmn651uh000a880hcl3ox9cxf':12A 'compon':75C 'continu':94C 'current':111C,131C 'ddos':3A,26B,88C,135C 'durat':68C 'europ':6A,15B,31B,139C 'europe-west':30B 'europe-west-netherland':14B 'experienc':132C 'gmt':84C,105C,126C 'hour':56B,70C 'identifi':128C 'inc':10A 'inc-northflank-cmn651uh000a880hcl3ox9cxf':9A 'incid':18B,49B,67C 'ingress':38B,147C 'intern':43B,151C 'job':62B,77C 'larg':25B,134C 'mar':79C,100C,121C 'mark':51B 'minut':59B,73C 'mitig':117C,162C 'monitor':96C,107C 'netherland':8A,17B,33B,141C 'northflank':1A,11A,13A,19B,22B 'ongo':119C 'public':37B,146C 'region':34B,99C,109C,142C 'report':23B 'resolv':52B,86C 'secur':20B 'servic':64B,78C 'stabl':112C 'still':115C 'stop':91C 'team':157C 'traffic':44B,152C 'type':66C 'vendor':21B 'west':7A,16B,32B,140C 'work':159C","nicknames":[],"mitigations":[],"who_affected":"Teams running addons, jobs or services on Northflank in the Europe-West Netherlands region were affected through their public ingress during the attack. The sources do not say what customers need to check or change; the incident is resolved and the vendor is monitoring the region.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["northflank"],"ptokens":["northflank"],"labels":["europewestnetherlands","incident","northflank","security","unknown","vendor"],"campaign_type":null,"search_a":"'activ':2A 'attack':4A 'cmn651uh000a880hcl3ox9cxf':12A 'ddos':3A 'europ':6A 'inc':10A 'inc-northflank-cmn651uh000a880hcl3ox9cxf':9A 'netherland':8A 'northflank':1A,11A,13A 'west':7A","search_b":"'21':58B '3':55B 'addon':61B 'affect':36B,47B,65B 'attack':27B 'cluster':41B 'ddos':26B 'europ':15B,31B 'europe-west':30B 'europe-west-netherland':14B 'hour':56B 'incid':18B,49B 'ingress':38B 'intern':43B 'job':62B 'larg':25B 'mark':51B 'minut':59B 'netherland':17B,33B 'northflank':19B,22B 'public':37B 'region':34B 'report':23B 'resolv':52B 'secur':20B 'servic':64B 'traffic':44B 'vendor':21B 'west':16B,32B","search_c":"'+0':85C,106C,127C '00':104C '01':103C '04':125C '14':123C '16':102C '17':81C '21':72C '25':80C,101C,122C '28':124C '3':69C '48':82C,83C 'activ':116C 'addit':161C 'addon':76C 'affect':74C,98C,145C,155C 'attack':89C,120C,136C 'cluster':150C 'compon':75C 'continu':94C 'current':111C,131C 'ddos':88C,135C 'durat':68C 'europ':139C 'experienc':132C 'gmt':84C,105C,126C 'hour':70C 'identifi':128C 'incid':67C 'ingress':147C 'intern':151C 'job':77C 'larg':134C 'mar':79C,100C,121C 'minut':73C 'mitig':117C,162C 'monitor':96C,107C 'netherland':141C 'ongo':119C 'public':146C 'region':99C,109C,142C 'resolv':86C 'servic':78C 'stabl':112C 'still':115C 'stop':91C 'team':157C 'traffic':152C 'type':66C 'west':140C 'work':159C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-03-25T14:28:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"northflank:cmn651uh000a880hcl3ox9cxf","url":"https://status.northflank.com/incident/cmn651uh000a880hcl3ox9cxf","severity":null,"published_at":"2026-03-25T14:28:04+00:00","modified_at":"2026-03-25T14:28:04+00:00","first_seen_at":"2026-11-08T16:58:28+00:00","fetched_at":"2026-11-09T03:33:18+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}