Northflank Urges Credential Rotation Following Security Breach and AI API Key Abuse

Overview of the Security Incident

Cloud application hosting platform Northflank has advised all customers to immediately rotate their credentials and secrets after a security breach resulted in the unauthorized use of customer AI API keys. Northflank enables developers to deploy and manage applications, containers, databases, and AI services without handling underlying infrastructure.

According to published incident updates, Northflank received a threat alert from cloud security firm Wiz on October 30. Following the notification, the company warned users to assume that all environment variables had been decrypted and that stored secrets were compromised.

Practical Implications and Risks

Applications routinely store sensitive data in environment variables, including:

• Database passwords
• Cloud service credentials
• Authentication tokens
• API keys

When exposed, these credentials can lead to unauthorized access, data theft, and unexpected billing. Northflank confirmed that multiple users reported unauthorized use of AI API keys stored on the platform.

Response and Mitigation Steps

Northflank's incident response included applying network policy patches, requesting assistance from Wiz, and enabling credential rotation for databases such as PostgreSQL, MongoDB, MySQL, and Redis. The company also enabled audit logs for all users, including free accounts, to aid investigations.

Recommended Actions for Customers:

• Immediately disable and rotate all user-provided secrets, environment variables, and global secrets stored on Northflank.
• Review AI provider usage and billing logs for unexpected activity.
• Report suspicious activity to Northflank and respective AI providers.
• Disable public access to add-ons where enabled.

Broader Context and LLMJacking

Security researchers at Wiz reported a series of incidents targeting AI development platforms in a report titled "Black October for AI Developer Platforms." The research highlighted multiple platforms experiencing security events, with attackers frequently targeting environment variables containing AI credentials.

This tactic, known as LLMJacking, involves using stolen API keys to access expensive AI models, generating massive bills or allowing unauthorized resale of AI access. Wiz noted instances where compromised credentials led to millions of unauthorized API calls and substantial financial charges.

How to Verify the Announcement

Users can verify official updates and instructions by visiting Northflank's official announcements page or reviewing direct communications sent to registered account administrators.