Northflank security breach leads to abuse of customers' AI API keys
Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys.
Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys.
The company disclosed a security incident on October 30, warning customers to immediately rotate their environment variables and API keys after receiving a threat alert from cloud security company Wiz.
According to Northflank's published incident timeline, Wiz warned them about the breach at 11:43 UTC on October 30, which the company's engineers reviewed one minute later.
Disable/rotate all keys," Northflank warned in an October 30 update.
Soon after, Northflank told all customers to assume their environment variables had been decrypted and that the secrets stored within them were stolen.
If exposed, these credentials can be used to breach other customer services, potentially leading to data theft or unauthorized charges through API keys.
The breach comes amid a series of attacks targeting AI development platforms, which security researchers believe are valuable targets because they store API keys that can be used to access expensive AI services.
The company has not disclosed how attackers gained access to its systems, how many customers were affected, or whether attackers stole or abused credentials other than the reported AI API keys.
BleepingComputer contacted Northflank with questions about the breach, its impact on customers, and whether stored credentials were accessed or stolen, but has not received a response.
Northflank later confirmed that multiple customers had reported unauthorized use of AI API keys stored on the platform.
What happened
Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys.
The company disclosed a security incident on October 30, warning customers to immediately rotate their environment variables and API keys after receiving a threat alert from cloud security company Wiz.
What changed
According to Northflank's published incident timeline, Wiz warned them about the breach at 11:43 UTC on October 30, which the company's engineers reviewed one minute later.
Disable/rotate all keys," Northflank warned in an October 30 update.
Who is affected
Soon after, Northflank told all customers to assume their environment variables had been decrypted and that the secrets stored within them were stolen.
If exposed, these credentials can be used to breach other customer services, potentially leading to data theft or unauthorized charges through API keys.
Why it matters
The breach comes amid a series of attacks targeting AI development platforms, which security researchers believe are valuable targets because they store API keys that can be used to access expensive AI services.
The company has not disclosed how attackers gained access to its systems, how many customers were affected, or whether attackers stole or abused credentials other than the reported AI API keys.
Technical details
BleepingComputer contacted Northflank with questions about the breach, its impact on customers, and whether stored credentials were accessed or stolen, but has not received a response.
Northflank later confirmed that multiple customers had reported unauthorized use of AI API keys stored on the platform.
The Railway incident also involved potential exposure of decrypted customer environment variables, while OpenCode disclosed exposed AI API keys.
Response
Northflank also referenced Wiz's research in its incident updates, noting that customer reports of unauthorized AI key usage may be tied to the attacks seen by the researchers.
Northflank quickly responded with a network policy patch, followed by further patches at 12:50 UTC and 13:05 UTC.
What security teams should do
The company also enabled audit logs for all customers, including those using free accounts, to help them investigate any suspicious activity.
Northflank continues to advise customers to rotate secrets stored in workloads, secret groups, and global secrets, and to disable public access to add-ons where enabled.
What remains unknown
The company has not disclosed how attackers gained access to its systems, how many customers were affected, or whether attackers stole or abused credentials other than the reported AI API keys.
Attribution
BleepingComputer: Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys.
What to watch next
Watch for updated vendor guidance and fixed-version details.