Northflank Breach Leads to Abuse of Customers’ AI API Keys

Northflank is telling every customer to replace credentials and secrets stored on its cloud platform after a security breach. Customers have reported unauthorized use of AI API keys, creating a risk of unexpected charges and further account access for small offices that build or host applications there.

What happened

Northflank disclosed the incident on October 30 after cloud security company Wiz alerted it to a threat. According to BleepingComputer, Northflank then told customers to assume that their environment variables had been decrypted and that secrets inside them had been stolen.

Environment variables can hold database passwords, cloud credentials, authentication tokens and API keys. Someone who obtains those secrets may be able to enter connected services, steal data or run up charges through metered APIs.

Northflank later confirmed that multiple customers had reported unauthorized use of AI API keys stored on the platform. It applied several network policy patches, added audit logs for all customers—including free accounts—and enabled credential rotation for PostgreSQL, MongoDB, MySQL and Redis.

The company has not disclosed how the attackers entered its systems, how many customers were affected or whether credentials other than the reported AI API keys were abused.

Who is affected

The warning applies to Northflank customers who stored user-provided credentials in workloads, secret groups, global secrets or environment variables. This may include developers, small businesses and offices using Northflank to operate applications, databases, containers or AI services.

Even if an account shows no obvious problem, Northflank’s guidance is to treat stored secrets as compromised. Businesses that connected the platform to an AI provider, database or cloud service should also examine those separate accounts.

What to do now

1. Open your Northflank account and inventory every stored secret. Check workloads, secret groups, global secrets and environment variables. Make a list of the outside services each credential unlocks before replacing it.

2. Rotate every key and password that was stored on Northflank. Sign in directly to each AI, cloud or database provider, revoke the old credential and create a new one. Then update the corresponding Northflank secret so legitimate applications continue working.

3. Review AI usage and billing dashboards. In each AI provider’s account portal, open the usage and billing sections and look for requests or charges your office does not recognize. Northflank advises reporting suspicious activity to both Northflank and the affected AI provider.

4. Inspect the newly available Northflank audit logs. Look for unfamiliar access or configuration activity around the incident. Audit logs are now available to free-account customers as well, according to BleepingComputer.

5. Check connected databases and cloud services. Review their access logs for unfamiliar locations, users or actions. If a stolen credential had broad permissions, examine the information and systems it could reach rather than assuming that replacing the key ends the investigation.

6. Disable public access to Northflank add-ons where it is enabled and unnecessary. Northflank specifically recommends restricting that exposure. Small offices can also use CyberSec24’s cybersecurity basics guide to review account access, backups and other protections.