Northflank Breach: Suspected Environment Variable Leak and Unauthorized Use of Customer AI API Keys
1. Basic Information Incident Name: Security incident Publisher: Northflank Publication Date: 2026-10-30 Original Source: Northflank Related Source: Northflank security breach leads to abuse of customers' AI API keys Related Malware: None specified Related Threat Group: None specified Related CVE:
Northflank notified all customers to assume that their stored environment variables were decrypted and compromised, and received reports from multiple customers regarding the unauthorized use of AI API keys. The initial access vector, the number of affected customers, and the abuse of non-AI credentials remain publicly undisclosed.
All secrets stored in Northflank must be treated as compromised. Unauthorized use of customer AI API keys has been reported, while exposure of other secrets could enable further compromise of cloud, database, and SaaS environments and financial losses.
Inference: The following are candidate logs to investigate within your organization. This depends on logging and retention configurations as well as product visibility, and does not mean all items were recorded in the primary source.
Inference: These are internal investigation procedures.
No additional hypotheses. Unconfirmed items are listed under "Unknowns and Limitations".
Organizations utilizing Northflank must inventory environment variables by secret type, revoke and reissue all credentials—including not only AI providers but also databases, cloud platforms, SaaS, CI/CD pipelines, signing keys, and webhooks—at their issuing sources, and retrospectively review provider-side audit logs and billing data around October 30.