Security notice

Site or app on Northflank? Northflank says assume every secret is exposed. Rotate everything today.

Last updated: Sunday, November 1, 2026, 9:43 AM ETStatus: Incident ongoing. Rotate every secret now.

Northflank is a cloud platform where developers host apps, databases and background jobs. On October 30, 2026 it reported a security incident. At 9:58 AM ET it told all customers: "Assume all environment variables have been decrypted. Disable/rotate all keys." Later that day it said users had reported unauthorised use of AI API keys supplied to the platform. Northflank has not said how the incident happened or how many customers are affected, and no customer has been named. If your website, store backend or app runs on Northflank, treat every key stored there as exposed: replace it, turn the old one off at the company that issued it, and check billing and usage records. Your payment, database, email, cloud and AI keys are all in scope.

Update, October 31, 2026

Northflank has widened secret rotation to MySQL, Redis, MinIO and RabbitMQ. At 9:34 AM ET (1:34 PM UTC) on October 31, Northflank posted: "Secret rotation for MySQL and Redis is now available to all customers. Please rotate all secrets if you have not already." This follows the rotation it enabled for Postgres and MongoDB on October 30. Later on October 31 it posted two more notices. At 6:32 PM ET (10:32 PM UTC): "Secret rotation for Minio Addons is now available to all customers. Please rotate all secrets if you have not already." At 7:31 PM ET (11:31 PM UTC): "Secret rotation is now available for RabbitMQ add-ons for all customers. Please rotate all secrets if you have not already." The wording says rotation is available, not that Northflank has already changed your passwords, so use the option on each add-on you run and check that your MySQL, Redis, MinIO and RabbitMQ passwords changed. Everything else in Northflank's guidance is unchanged: assume every environment variable was decrypted and rotate all secrets, revoke the old ones at each provider, turn off public addon access, and check billing and audit logs. When we checked at 10:14 PM ET, the RabbitMQ notice was the newest update on its status page and the incident was still listed as identified, not resolved. (Northflank status)

What happened

Northflank's own incident page is the main source. Times below are Eastern Time (ET). Northflank posts in UTC, which is four hours ahead of ET. (Northflank status)

The alert (7:43 AM ET, October 30). Northflank's timeline says a threat alert from the security firm Wiz arrived at 11:43 UTC and its engineers reviewed it a minute later. It lists a network policy patch at 12:02 UTC (8:02 AM ET), more patching at 12:50 and 13:05 UTC (8:50 and 9:05 AM ET), and a request for Wiz's incident response team at 13:00 UTC (9:00 AM ET). The page does not say what the alert showed. (Northflank status)
First warning (9:40 AM ET). At 1:40 PM UTC Northflank posted: "Rotate environment variables immediately." Its page shows the incident as a major outage on the Northflank Platform, affecting 7 components. (Northflank status)
"Assume all environment variables have been decrypted" (9:58 AM ET). At 1:58 PM UTC Northflank posted: "Assume all environment variables have been decrypted. Disable/rotate all keys." (Northflank status)
Database secret rotation and the first reports of misuse (11:12 AM ET). At 3:12 PM UTC Northflank said secret rotation on Postgres and MongoDB had been enabled for all users and recommended disabling public expose on addons. It told all users to begin rotating secrets on workloads, secret groups and global secrets, and wrote: "Multiple users are confirming that their AI keys have been used." (Northflank status)
No new findings (3:28 PM ET). At 7:28 PM UTC Northflank said its investigation was ongoing, it had no further confirmed findings, and its guidance was unchanged. (Northflank status, RuntimeWire)
Unauthorised use of AI keys (7:38 PM ET). At 11:38 PM UTC Northflank said users had reported unauthorised use of AI API keys supplied to the platform. It told customers to revoke existing credentials with the companies that issued them, generate replacements, update the affected secrets and workloads, review AI provider usage and billing logs for unexpected activity, and report suspicious usage to Northflank support and the provider. It said these reports "may be consistent with the broader pattern of attacks targeting AI credentials" and linked the Wiz report below. (Northflank status)
Audit logs turned on (9:04 PM ET, October 30). At 1:04 AM UTC on October 31, Northflank said it had enabled audit logs for all customers, including free users. It has not said whether they cover activity from before that time. (Northflank status)
Rotation for MySQL and Redis (9:34 AM ET, October 31). At 1:34 PM UTC Northflank said: "Secret rotation for MySQL and Redis is now available to all customers. Please rotate all secrets if you have not already." (Northflank status)
Rotation for MinIO (6:32 PM ET, October 31). At 10:32 PM UTC Northflank said: "Secret rotation for Minio Addons is now available to all customers. Please rotate all secrets if you have not already." (Northflank status)
Rotation for RabbitMQ (7:31 PM ET, October 31). At 11:31 PM UTC Northflank said: "Secret rotation is now available for RabbitMQ add-ons for all customers. Please rotate all secrets if you have not already." (Northflank status)
What is not known. Northflank has not disclosed the cause. RuntimeWire reports that the company did not identify the affected customers or AI providers, say how much the keys were used or say who used them. We are not aware of any named company being breached.
Other platforms. On October 30, Wiz published a report listing at least nine AI developer platforms that disclosed incidents in October, including Northflank (October 30) and Railway (October 20). Wiz says all the public reports point to targeted attacks hunting stored environment variables, with a focus on those that grant access to AI models, and that "there is no single vulnerability or dependency linking these attacks." Whether one attacker is behind more than one of them is not established. We covered the Railway incident in our Railway notice. (Wiz)

Who should worry

This is about websites, online stores and apps that run on Northflank. If you are not sure where your site or app is hosted, ask your web developer or agency. Ask about this if any of these are true:

Your website, store backend, booking system, API or app runs on Northflank.
Your database (Postgres or MongoDB, for example) is hosted as a Northflank addon.
Your agency or developer hosts client projects on Northflank.
Your developer keeps AI service keys, payment keys or cloud keys in Northflank.

A stolen payment key can let someone read customer and payment records or tamper with payouts. A stolen database password can expose customer records. A stolen AI key can run up a large bill on your account, which is what Northflank says some users are reporting. If you do not use Northflank, this notice does not apply to you.

What to do now

Do these today. Most of them are jobs for your developer.

Ask the question. Send the message below to your developer or agency. You need a clear yes or no: does anything we run live on Northflank?
Rotate every secret stored in Northflank. That means secrets on workloads, in secret groups and in global secrets, as Northflank says. Start with payment keys, then database passwords, then cloud and storage keys, email and other API keys, then AI keys. Rotating means creating a new key at the company that issued it and turning the old one off. (Northflank status)
Turn off the old keys at each provider. Northflank says to revoke existing credentials with their issuing providers, not just change the value in Northflank. Then update the new values in Northflank and redeploy, and confirm the old keys no longer work. (Northflank status)
Turn off public access to addons. Northflank recommends disabling public expose on addons such as databases if you had it on. Northflank says it enabled secret rotation on Postgres and MongoDB on October 30 and made it available for MySQL, Redis, MinIO and RabbitMQ on October 31, but its wording does not say it changed your passwords for you, so use the rotation option on each add-on you run and check that your database, cache, storage and queue passwords actually changed. (Northflank status)
Check for misuse. Review your AI provider's usage and billing for activity you do not recognize, and report anything suspicious to Northflank support and the provider. Also check your payment provider (charges, refunds, payouts, new team members or webhooks you do not recognize), your cloud account, and your database and email logs. (Northflank status)
Look at the Northflank audit logs. They are now on for every customer. Ask your developer to review them for changes you did not make, remembering they were only switched on late on October 30. (Northflank status)
Watch the status page. Northflank says it will share more updates as they are confirmed. (Northflank status)

What to send your developer or agency

Northflank reported a security incident on October 30, 2026 and told all customers to assume every environment variable has been decrypted and to rotate all secrets, including those in workloads, secret groups and global secrets, and to disable public access to addons. It says users have reported unauthorised use of AI API keys. Please confirm whether any of our sites, stores, databases or apps run on Northflank. If so, please rotate every secret today, starting with payment keys and database passwords, revoke the old ones at each provider, update Northflank and redeploy, turn off public addon access, check AI provider usage and billing and our payment provider's logs for misuse, review the Northflank audit logs, and tell us what you find. Sources: Northflank status page, RuntimeWire, Wiz.

Technical steps

Step 1. List every secret in every Northflank project: workload variables, secret groups and global secrets. Include addon connection details. Step 2. Rotate at the provider first (payment, database, cloud, email, Git, AI), revoke the old key there, then update the Northflank secret and redeploy. Step 3. Confirm the old keys now fail. Step 4. Switch off public expose on every addon that does not need it. Step 5. Review provider logs for activity from unfamiliar addresses since the morning of October 30, and the Northflank audit log. (Northflank status)

Common questions

Has my business been hacked?

This notice does not mean your business has been hacked. Northflank has not said which customers were affected. But it tells every customer to assume their stored environment variables were decrypted, and some users report their AI keys were used, so treat the keys as exposed and rotate them. (Northflank status)

Can EverThread tell me if I am affected?

No. EverThread does not test for this. We check your website from the outside, the way a browser sees it. We cannot see your hosting account, your environment variables or your provider logs, so we cannot tell whether your keys were exposed or used. Your developer and your providers can check that. Our free scan does look at your home page for other common problems, such as an expired padlock certificate, missing browser safety settings and files that should not be public.

My site is not on Northflank. Do I need to do anything?

Not for this incident. If you are not sure where your site or app is hosted, ask your developer.

Is this the same as the Railway breach?

They are separate companies and separate incidents. Wiz lists both among nine platforms that disclosed incidents in October but says no single vulnerability links them. See our Railway notice if you use Railway. (Wiz)

Where can I follow official updates?

The Northflank status page is Northflank's own account. All current notices are on our notices page.

Security alerts by email

Hear about the next one first.

When a flaw puts websites at risk, we send one plain-English email: what happened, who it affects and what to do. It's free, whether or not you use EverThread.

Sources

Northflank: Security incident, incident details, status page, updates from October 30, 2026 to October 31, 2026 (11:31 PM UTC on October 31), checked October 31, 2026, and again at 10:14 PM ET
RuntimeWire: Northflank tells customers to assume all environment variables are compromised as users report AI-key abuse, Emerson Redding, October 30, 2026 (the free copy is cut off after its first paragraphs), checked October 31, 2026
Wiz: "Black October" for AI Developer Platforms, October 30, 2026, checked October 31, 2026