Northflank Warns Users of Secret Theft After Security Breach
Cloud application hosting platform Northflank has advised customers to assume that all environment variables and stored secrets were stolen following a security breach that led to the unauthorized use of AI API keys.
Radwan AbdulhadiEditor and technology writer
Security Incident and Initial Warning
Cloud application hosting platform Northflank has issued an urgent warning instructing customers to rotate all credentials and secrets stored on its platform following a security breach. Northflank is a cloud platform that allows developers to deploy and manage applications, containers, databases, and AI applications without managing underlying infrastructure.
The company <a href="https://status.northflank.com/">disclosed a security incident</a> on October 30 after receiving a threat alert from cloud security company Wiz. Soon after, Northflank instructed all customers to assume their environment variables had been decrypted and that the sensitive secrets stored within them had been stolen.
Exposure of Environment Variables and AI API Keys
Applications commonly use environment variables to store sensitive information, including database passwords, cloud service credentials, authentication tokens, and API keys. If exposed, these credentials can be used to breach other customer services, potentially leading to data theft or unauthorized charges through exposed API keys.
Northflank later confirmed that multiple customers had reported the unauthorized use of AI API keys stored on the platform. The company urged users who had not already rotated their user-provided secrets to do so immediately and advised them to review their AI provider usage and billing logs for unexpected activity.
Incident Timeline and Mitigation Efforts
According to Northflank's published incident timeline, Wiz warned the company about the breach at 11:43 UTC on October 30, which engineers reviewed one minute later. Northflank responded by deploying a network policy patch, followed by additional patches, and requested assistance from Wiz's incident response team.
As part of its ongoing response, Northflank enabled credential rotation for PostgreSQL, MongoDB, MySQL, and Redis. The platform also enabled audit logs for all customers, including free accounts, to help them investigate suspicious activity, while advising users to rotate secrets in workloads and disable public access to add-ons where enabled.
Context of Attacks on AI Developer Platforms
The security breach at Northflank occurred during a challenging period for AI developer platforms, which researchers say are valuable targets because they store API keys providing access to expensive AI services. Wiz detailed these events in a published report titled <a href="http://www.wiz.io/blog/black-october-for-ai-developer-platforms">Black October for AI Developer Platforms</a>, which identified multiple security incidents affecting platforms during the month.
Other platforms affected during the month include <a href="https://www.bleepingcomputer.com/news/security/railway-warns-devs-to-rotate-secrets-after-potential-breach/">Railway</a>, which warned developers to rotate secrets after a potential breach involving decrypted environment variables, and <a href="https://www.bleepingcomputer.com/news/security/opencode-hack-exposes-api-keys-amid-ai-distillation-attacks/">OpenCode</a>, which disclosed exposed API keys. Additionally, <a href="https://www.bleepingcomputer.com/news/security/warp-discloses-breach-exposing-ai-agent-logs-user-telemetry-data/">Warp</a> reported a breach that exposed AI agent logs and user telemetry data.
Risks of LLMJacking and Unauthorized Usage
Security researchers note that attackers have specifically targeted environment variables containing AI service credentials, exploiting them through a practice known as <a href="https://www.bleepingcomputer.com/news/security/hackers-hijack-exposed-llm-endpoints-in-bizarre-bazaar-operation/">LLMJacking</a>. This technique involves using stolen credentials to access AI models using another organization's API keys, generating massive charges or allowing unauthorized access to be resold.
In investigations conducted by Wiz, compromised enterprise credentials were used in some instances to make millions of API calls, generating substantial costs in unauthorized AI usage. Northflank has not disclosed how attackers gained access to its systems or how many customers were ultimately affected, but continues to urge all users to secure their accounts.
Sources
- BleepingComputerNorthflank security breach leads to abuse of customers' AI API keys
Continue chronologically
Related stories
How AI Tools Helped Uncover Years-Old PHP Vulnerabilities
Security researchers used frontier artificial intelligence tools to expose long-standing flaws in the PHP scripting language, triggering rapid attacks.
Hackers Had Four-Day Head Start on Epic PHP2Shell Flaw
Amazon reveals hackers probed the critical PHP2Shell security vulnerability four days before public disclosure, triggering a global patch rush.
Google Launches Gemini 4 Argon Without Guardrails
Google has announced Gemini 4 Argon, a new frontier AI model providing guardrail-free cybersecurity access to trusted defenders through the Fairwind Program.
Hackers Hit OpenCode Console, Stole API Keys and Ran Up Charges
Hackers breached an older OpenCode platform system, compromising user API keys and running up massive unauthorized AI service charges.
