{"id":"INC-northflank-cmp05l0ln00fo96bh1a4pufch","kind":"incident","aliases":[],"related":[],"title":"Northflank: Active DDoS Attack in Europe - West - Netherlands","description":"Type: Incident\n    Duration: 2 hours and 2 minutes\n\n    Affected Components: Addons, Services\n    May 10, 20:31:56 GMT+0 - Resolved - This incident has been resolved. May 10, 20:10:07 GMT+0 - Monitoring - We have put in place mitigations and are monitoring the affected region. May 10, 18:30:00 GMT+0 - Identified - We are currently experiencing a large DDoS attack in the Europe - West - Netherlands region. This is affecting public ingress into the cluster. Internal traffic is not affected. The team is working on additional mitigations.","summary":"Northflank had a large DDoS attack on its Europe-West Netherlands region that affected public ingress into the cluster for about two hours. The incident is marked resolved, and internal traffic was not affected.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Northflank","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["addons","europe-west","incident","northflank","security","services","vendor"],"not_affected_if":["internal-only-traffic","other-regions"],"how_to_check":null,"fix":null,"status":"resolved","published_at":"2026-05-10T18:30:00+00:00","first_seen_at":"2026-11-08T16:58:28+00:00","triaged_at":"2026-11-08T17:03:24+00:00","updated_at":"2026-11-08T17:03:24+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-08T17:03:24Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Northflank: DDoS attack disrupted public traffic in Netherlands region","impact":"low","summary":"Northflank had a large DDoS attack on its Europe-West Netherlands region that affected public ingress into the cluster for about two hours. The incident is marked resolved, and internal traffic was not affected.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["northflank","europe-west","addons","services"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Public service availability disrupted for about two hours","analyst_note":"","how_to_check":"unknown","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["other-regions","internal-only-traffic"],"who_is_affected":"Teams running addons or services on Northflank in the Europe-West Netherlands region may have seen public traffic fail during the incident window. The sources do not describe any action a customer needed to take, and the incident is resolved.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000664,"input_tokens":4683,"output_tokens":392,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':76C,89C,109C '00':107C '07':87C '10':71C,84C,86C,104C '18':105C '2':61C,64C '20':72C,85C '30':106C '31':73C '56':74C 'activ':2A 'addit':143C 'addon':14B,68C 'affect':37B,57B,66C,101C,127C,137C 'attack':4A,28B,118C 'cluster':42B,132C 'cmp05l0ln00fo96bh1a4pufch':12A 'compon':67C 'current':113C 'ddos':3A,27B,117C 'durat':60C 'europ':6A,16B,32B,121C 'europe-west':15B,31B 'experienc':114C 'gmt':75C,88C,108C 'hour':46B,62C 'identifi':110C 'inc':10A 'inc-northflank-cmp05l0ln00fo96bh1a4pufch':9A 'incid':18B,48B,59C,79C 'ingress':39B,129C 'intern':53B,133C 'larg':26B,116C 'mark':50B 'may':70C,83C,103C 'minut':65C 'mitig':96C,144C 'monitor':90C,99C 'netherland':8A,34B,123C 'northflank':1A,11A,13A,19B,23B 'place':95C 'public':38B,128C 'put':93C 'region':35B,102C,124C 'resolv':51B,77C,82C 'secur':20B 'servic':21B,69C 'team':139C 'traffic':54B,134C 'two':45B 'type':58C 'vendor':22B 'west':7A,17B,33B,122C 'work':141C","nicknames":[],"mitigations":[],"who_affected":"Teams running addons or services on Northflank in the Europe-West Netherlands region may have seen public traffic fail during the incident window. The sources do not describe any action a customer needed to take, and the incident is resolved.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["northflank"],"ptokens":["northflank"],"labels":["addons","europewest","incident","northflank","security","services","unknown","vendor"],"campaign_type":null,"search_a":"'activ':2A 'attack':4A 'cmp05l0ln00fo96bh1a4pufch':12A 'ddos':3A 'europ':6A 'inc':10A 'inc-northflank-cmp05l0ln00fo96bh1a4pufch':9A 'netherland':8A 'northflank':1A,11A,13A 'west':7A","search_b":"'addon':14B 'affect':37B,57B 'attack':28B 'cluster':42B 'ddos':27B 'europ':16B,32B 'europe-west':15B,31B 'hour':46B 'incid':18B,48B 'ingress':39B 'intern':53B 'larg':26B 'mark':50B 'netherland':34B 'northflank':19B,23B 'public':38B 'region':35B 'resolv':51B 'secur':20B 'servic':21B 'traffic':54B 'two':45B 'vendor':22B 'west':17B,33B","search_c":"'+0':76C,89C,109C '00':107C '07':87C '10':71C,84C,86C,104C '18':105C '2':61C,64C '20':72C,85C '30':106C '31':73C '56':74C 'addit':143C 'addon':68C 'affect':66C,101C,127C,137C 'attack':118C 'cluster':132C 'compon':67C 'current':113C 'ddos':117C 'durat':60C 'europ':121C 'experienc':114C 'gmt':75C,88C,108C 'hour':62C 'identifi':110C 'incid':59C,79C 'ingress':129C 'intern':133C 'larg':116C 'may':70C,83C,103C 'minut':65C 'mitig':96C,144C 'monitor':90C,99C 'netherland':123C 'place':95C 'public':128C 'put':93C 'region':102C,124C 'resolv':77C,82C 'servic':69C 'team':139C 'traffic':134C 'type':58C 'west':122C 'work':141C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-05-10T18:30:00+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"northflank:cmp05l0ln00fo96bh1a4pufch","url":"https://status.northflank.com/incident/cmp05l0ln00fo96bh1a4pufch","severity":null,"published_at":"2026-05-10T18:30:00+00:00","modified_at":"2026-05-10T18:30:00+00:00","first_seen_at":"2026-11-08T16:58:28+00:00","fetched_at":"2026-11-09T02:40:07+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}