Northflank bestätigt Sicherheitsvorfall: KI-API-Schluessel von Kunden offenbar missbraucht
Der Anbieter Northflank meldet einen Sicherheitsvorfall vom 30. Oktober 2026, bei dem vermutlich Umgebungsvariablen geleakt wurden und KI-API-Schluessel von Kunden unbefugt genutzt wurden. Details zu Umfang und Ursache sind bislang begrenzt.
Northflank notified all customers to assume that their stored environment variables were decrypted and compromised, and received reports from multiple customers regarding the unauthorized use of AI API keys. The initial access vector, the number of affected customers, and the abuse of non-AI credentials remain publicly undisclosed.
All secrets stored in Northflank must be treated as compromised. Unauthorized use of customer AI API keys has been reported, while exposure of other secrets could enable further compromise of cloud, database, and SaaS environments and financial losses.
Inference: The following are candidate logs to investigate within your organization. This depends on logging and retention configurations as well as product visibility, and does not mean all items were recorded in the primary source.
Inference: These are internal investigation procedures.
No additional hypotheses. Unconfirmed items are listed under "Unknowns and Limitations".
Organizations utilizing Northflank must inventory environment variables by secret type, revoke and reissue all credentials—including not only AI providers but also databases, cloud platforms, SaaS, CI/CD pipelines, signing keys, and webhooks—at their issuing sources, and retrospectively review provider-side audit logs and billing data around October 30.