Northflank is telling customers to disable or rotate all keys during a security incident affecting its deployment platform. Its October 30 status notice, updated at 13:58 UTC, says: “Assume all environment variables have been decrypted. Disable/rotate all keys.”
Evidence status: a first-party incident warning with precautionary exposure guidance. The notice does not publish a forensic account proving that every customer’s variables were read or used. Its instruction is nevertheless broad: customers should treat secrets stored in those variables as potentially exposed.
Environment variables are settings passed to running applications. They often contain credentials for databases, cloud accounts and external services. Replacing a value in Northflank changes what an application receives; revoking the old credential at its issuer stops that credential from working elsewhere.
What the public timeline establishes
The notice records a Wiz threat alert at 11:43 UTC, engineer review a minute later, and an initial network-policy patch at 12:02 UTC. It lists additional patching at 12:50 and 13:05 UTC, with Wiz’s incident-response team requested at 13:00 UTC.
Northflank first posted “Rotate environment variables immediately” at 13:40 UTC, then strengthened that instruction at 13:58 UTC. At review, the incident remained Identified, with a Major outage label. Patch deployment is a containment step; these updates do not announce a completed investigation or recovery.
The public notice gives no entry mechanism, affected software version, attacker identity or affected-customer count. It also provides no narrower tenant or time-window exception to the rotation instruction.
Update — October 30, 2026, 12:42 EDT: customers report AI-key misuse
Northflank’s 15:12 UTC update says: “Multiple users are confirming that their AI keys have been used.” This changes the earlier account, which had no reported downstream misuse. Evidence status: customer-reported credential use relayed by the affected provider, without public logs or an independently verified victim count.
The same update says Postgres and MongoDB secret rotation is now enabled for all users. It recommends disabling public exposure on addons where enabled. Its rotation warning explicitly includes secrets on workloads, secret groups and global secrets.
Review all three locations and use the newly available database-rotation controls where applicable. Check AI-provider usage, billing and access records for unexpected activity, alongside revoking exposed keys. Northflank’s wording does not establish which keys were used, how they were obtained, or the cost of any misuse.
The notice still labels the incident Identified / Major outage. Enabling rotation is a response measure, not a declaration that the investigation or recovery is complete.
Revoke credentials and check their downstream use
Northflank’s explicit direction is to rotate or disable keys. For an operator carrying that out, the practical sequence is:
- Inventory credentials supplied through Northflank environment variables, including shared configurations. Identify their issuing services and the applications that depend on them.
- Revoke or rotate them at those services, using a trusted administrative session. Updating the stored variable alone leaves an old API key or database password usable.
- Deploy the replacement values and verify that running workloads use them. Coordinate the change with each service’s rotation process to avoid leaving stale credentials or broken applications behind.
- Preserve and review available access records at the issuing services. Check unexpected sessions, token use and permission changes. These checks investigate possible misuse; this notice does not establish that such misuse occurred.
That sequence is operational guidance derived from the exposure warning, rather than a claim that Northflank has published a complete recovery procedure. Follow the same incident page for revised scope and recovery instructions.
Caveat: Northflank is the affected provider and the source of the warning. The public updates leave the cause, actual data access and downstream impact unresolved.