---
id: "INC-northflank-cmrujwsz307ud0kqm1nugymth"
page: "https://infrastack.ai/live/INC-northflank-cmrujwsz307ud0kqm1nugymth"
kind: "incident"
aliases: []
title: "Northflank: Active DDoS Attack in US - Central"
severity: "low"
cvss: null
epss: null
exploited: false
status: "resolved"
category: "vendor"
products: [{"name": "Northflank", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["incident", "kubernetes", "northflank", "security", "self-hosted", "vendor"]
not_affected_if: ["internal-only-services", "other-regions"]
published_at: "2026-07-21T11:09:21+00:00"
first_seen_at: "2026-11-08T16:58:28+00:00"
updated_at: "2026-11-08T16:59:15+00:00"
sources: [{"source": "statuspage", "url": "https://status.northflank.com/incident/cmrujwsz307ud0kqm1nugymth", "first_seen_at": "2026-11-08T16:58:28+00:00"}]
exploit_sources: []
---

# Northflank: Active DDoS Attack in US - Central

Link for people: https://infrastack.ai/live/INC-northflank-cmrujwsz307ud0kqm1nugymth (this .md is for agents)

Northflank reported a DDoS attack against its US-Central region that affected public ingress into clusters while internal traffic stayed up. The incident was marked resolved after about 2 hours and 49 minutes, with mitigations in place.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Northflank affected range not listed fixed no fixed version listed

## How to check

- Check the Northflank status page for the incident at https://status.northflank.com/incident/cmrujwsz307ud0kqm1nugymth
- Confirm whether your workloads run in the US-Central region

## Timeline

- 2026-11-08T16:58:28+00:00 statuspage https://status.northflank.com/incident/cmrujwsz307ud0kqm1nugymth

## From the sources

Type: Incident
    Duration: 2 hours and 49 minutes

    Affected Components: Networking
    Jul 21, 13:58:28 GMT+0 - Resolved - This incident has been resolved. We will continue to monitor the affected region. Jul 21, 13:43:46 GMT+0 - Monitoring - We have implemented mitigations are monitoring the situation. Jul 21, 13:23:09 GMT+0 - Identified - We are currently experiencing a DDoS attack in the US - Central region. This is affecting public ingress into the cluster. Internal traffic is not affected. The team is working on additional mitigations. Jul 21, 11:41:41 GMT+0 - Resolved - The DDoS attack has stopped, we will continue to monitor the affected region. Jul 21, 11:20:15 GMT+0 - Monitoring - We have implemented mitigations are monitoring the situation. Jul 21, 11:09:21 GMT+0 - Identified - We are currently experiencing a DDoS attack in the US - Central region. This is affecting public ingress into the cluster. Internal traffic is not affected. The team is working on additional mitigations.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_