{"id":"INC-northflank-cmrujwsz307ud0kqm1nugymth","kind":"incident","aliases":[],"related":[],"title":"Northflank: Active DDoS Attack in US - Central","description":"Type: Incident\n    Duration: 2 hours and 49 minutes\n\n    Affected Components: Networking\n    Jul 21, 13:58:28 GMT+0 - Resolved - This incident has been resolved. We will continue to monitor the affected region. Jul 21, 13:43:46 GMT+0 - Monitoring - We have implemented mitigations are monitoring the situation. Jul 21, 13:23:09 GMT+0 - Identified - We are currently experiencing a DDoS attack in the US - Central region. This is affecting public ingress into the cluster. Internal traffic is not affected. The team is working on additional mitigations. Jul 21, 11:41:41 GMT+0 - Resolved - The DDoS attack has stopped, we will continue to monitor the affected region. Jul 21, 11:20:15 GMT+0 - Monitoring - We have implemented mitigations are monitoring the situation. Jul 21, 11:09:21 GMT+0 - Identified - We are currently experiencing a DDoS attack in the US - Central region. This is affecting public ingress into the cluster. Internal traffic is not affected. The team is working on additional mitigations.","summary":"Northflank reported a DDoS attack against its US-Central region that affected public ingress into clusters while internal traffic stayed up. The incident was marked resolved after about 2 hours and 49 minutes, with mitigations in place.","severity":"low","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Northflank","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["incident","kubernetes","northflank","security","self-hosted","vendor"],"not_affected_if":["internal-only-services","other-regions"],"how_to_check":"- Check the Northflank status page for the incident at https://status.northflank.com/incident/cmrujwsz307ud0kqm1nugymth\n- Confirm whether your workloads run in the US-Central region","fix":null,"status":"resolved","published_at":"2026-07-21T11:09:21+00:00","first_seen_at":"2026-11-08T16:58:28+00:00","triaged_at":"2026-11-08T16:59:15+00:00","updated_at":"2026-11-08T16:59:15+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-08T16:59:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"Northflank: DDoS attack disrupted public ingress in US-Central region","impact":"low","summary":"Northflank reported a DDoS attack against its US-Central region that affected public ingress into clusters while internal traffic stayed up. The incident was marked resolved after about 2 hours and 49 minutes, with mitigations in place.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["northflank","kubernetes","self-hosted"],"confidence":0.6,"fix_status":"none","needs_auth":"no","worst_case":"Public ingress to affected clusters is disrupted for hours","analyst_note":"","how_to_check":"- Check the Northflank status page for the incident at https://status.northflank.com/incident/cmrujwsz307ud0kqm1nugymth\n- Confirm whether your workloads run in the US-Central region","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["other-regions","internal-only-services"],"who_is_affected":"Customers whose public services ran on Northflank clusters in the US-Central region during the attack window on July 21 were likely affected by reduced public reachability. Internal cluster traffic was not affected, and the sources describe no customer-side vulnerability or action to take.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"low"},"cost_usd":0.000726,"input_tokens":4859,"output_tokens":480,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':76C,97C,113C,153C,174C,190C '09':111C,187C '11':149C,170C,186C '13':72C,93C,109C '15':172C '2':50B,62C '20':171C '21':71C,92C,108C,148C,169C,185C,188C '23':110C '28':74C '41':150C,151C '43':94C '46':95C '49':53B,65C '58':73C 'activ':2A 'addit':145C,222C 'affect':33B,67C,89C,129C,139C,166C,206C,216C 'attack':4A,25B,121C,157C,198C 'central':7A,30B,125C,202C 'cluster':37B,134C,211C 'cmrujwsz307ud0kqm1nugymth':11A 'compon':68C 'continu':85C,162C 'current':117C,194C 'ddos':3A,24B,120C,156C,197C 'durat':61C 'experienc':118C,195C 'gmt':75C,96C,112C,152C,173C,189C 'host':19B 'hour':51B,63C 'identifi':114C,191C 'implement':101C,178C 'inc':9A 'inc-northflank-cmrujwsz307ud0kqm1nugymth':8A 'incid':13B,44B,60C,79C 'ingress':35B,131C,208C 'intern':39B,135C,212C 'jul':70C,91C,107C,147C,168C,184C 'kubernet':14B 'mark':46B 'minut':54B,66C 'mitig':56B,102C,146C,179C,223C 'monitor':87C,98C,104C,164C,175C,181C 'network':69C 'northflank':1A,10A,12A,15B,21B 'place':58B 'public':34B,130C,207C 'region':31B,90C,126C,167C,203C 'report':22B 'resolv':47B,77C,82C,154C 'secur':16B 'self':18B 'self-host':17B 'situat':106C,183C 'stay':41B 'stop':159C 'team':141C,218C 'traffic':40B,136C,213C 'type':59C 'us':6A,29B,124C,201C 'us-centr':28B 'vendor':20B 'work':143C,220C","nicknames":[],"mitigations":[],"who_affected":"Customers whose public services ran on Northflank clusters in the US-Central region during the attack window on July 21 were likely affected by reduced public reachability. Internal cluster traffic was not affected, and the sources describe no customer-side vulnerability or action to take.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["northflank"],"ptokens":["northflank"],"labels":["incident","kubernetes","low","northflank","security","selfhosted","vendor"],"campaign_type":null,"search_a":"'activ':2A 'attack':4A 'central':7A 'cmrujwsz307ud0kqm1nugymth':11A 'ddos':3A 'inc':9A 'inc-northflank-cmrujwsz307ud0kqm1nugymth':8A 'northflank':1A,10A,12A 'us':6A","search_b":"'2':50B '49':53B 'affect':33B 'attack':25B 'central':30B 'cluster':37B 'ddos':24B 'host':19B 'hour':51B 'incid':13B,44B 'ingress':35B 'intern':39B 'kubernet':14B 'mark':46B 'minut':54B 'mitig':56B 'northflank':15B,21B 'place':58B 'public':34B 'region':31B 'report':22B 'resolv':47B 'secur':16B 'self':18B 'self-host':17B 'stay':41B 'traffic':40B 'us':29B 'us-centr':28B 'vendor':20B","search_c":"'+0':76C,97C,113C,153C,174C,190C '09':111C,187C '11':149C,170C,186C '13':72C,93C,109C '15':172C '2':62C '20':171C '21':71C,92C,108C,148C,169C,185C,188C '23':110C '28':74C '41':150C,151C '43':94C '46':95C '49':65C '58':73C 'addit':145C,222C 'affect':67C,89C,129C,139C,166C,206C,216C 'attack':121C,157C,198C 'central':125C,202C 'cluster':134C,211C 'compon':68C 'continu':85C,162C 'current':117C,194C 'ddos':120C,156C,197C 'durat':61C 'experienc':118C,195C 'gmt':75C,96C,112C,152C,173C,189C 'hour':63C 'identifi':114C,191C 'implement':101C,178C 'incid':60C,79C 'ingress':131C,208C 'intern':135C,212C 'jul':70C,91C,107C,147C,168C,184C 'minut':66C 'mitig':102C,146C,179C,223C 'monitor':87C,98C,104C,164C,175C,181C 'network':69C 'public':130C,207C 'region':90C,126C,167C,203C 'resolv':77C,82C,154C 'situat':106C,183C 'stop':159C 'team':141C,218C 'traffic':136C,213C 'type':59C 'us':124C,201C 'work':143C,220C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-07-21T11:09:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"statuspage","external_id":"northflank:cmrujwsz307ud0kqm1nugymth","url":"https://status.northflank.com/incident/cmrujwsz307ud0kqm1nugymth","severity":null,"published_at":"2026-07-21T11:09:21+00:00","modified_at":"2026-07-21T11:09:21+00:00","first_seen_at":"2026-11-08T16:58:28+00:00","fetched_at":"2026-11-08T19:16:33+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}