Northflank breach: what to rotate (and reconnect) after the Oct 30 incident
Everything you stored there. Northflank's status page told customers on Oct 30 to "Assume all environment variables have been decrypted. Disable/rotate all keys," and its Nov 2 update (11:09 UTC) says to "rotate all secrets now, both integration secrets and project secrets, even if you haven't seen suspicious activity," starting with AI provider keys, cloud provider credentials, payment provider keys, private keys, and database and other service credentials, in that order.
Rotating means revoking at the provider that issued the key, not just pasting a new value into Northflank: a decrypted value keeps working until OpenAI, AWS or Stripe stops accepting it. Northflank also revoked its own access tokens and sessions, VCS integrations and cross-account IAM roles where it could, so you have to sign in again and reconnect those.
What Northflank has said (Oct 30 – Nov 2)
Oct 30, 11:43 UTC: a Wiz threat alert; Northflank engineers reviewed it a minute later and deployed a network policy patch at 12:02 UTC, with more patches at 12:50 and 13:05 UTC, and asked Wiz's incident response team for help.
Oct 30, 13:58 UTC: "Assume all environment variables have been decrypted." The rotation covers secrets on workloads, secret groups and global secrets. Northflank also recommends disabling public access to add-ons where it is enabled.
Oct 30, 15:12 and 23:38 UTC: multiple users confirmed their AI keys had been used. Northflank's instruction: "Revoke existing credentials with their issuing providers, generate replacements, and update the affected secrets and workloads in Northflank," review AI provider usage and billing logs, and report suspicious usage to Northflank support and the provider.
Oct 30 – 31: add-on secret rotation became available for Postgres and MongoDB, then MySQL and Redis, MinIO and RabbitMQ. Audit logs were enabled for every customer, including free accounts.
Nov 2, 11:09 UTC: Northflank believes the attack vector was contained within an hour of the first alert. Running workloads were unaffected and it has seen no sign that workload data was accessed; the evidence points at "secrets held in our control plane." Customers on forward-deployed or dedicated control planes are unaffected. It has patched CVE-2026-98432 across its fleet, including connected BYOC clusters, and asks owners of BYOC clusters no longer connected to contact support. Independent forensic auditors are reviewing the attack; a root cause analysis is promised once findings are confirmed.
Before you revoke: pull the logs
Northflank says to review your AI provider usage and billing logs and, if you see unexpected usage or spend, to contact the provider directly. Export or screenshot each key's usage and the billing for October now, while you still know which key was which. It takes minutes and it is what the provider will ask for. Then revoke.
Northflank says the IP addresses in reports of misused keys resemble those in Wiz's "Black October" report, which lists IPs and hosting networks seen testing and abusing stolen AI keys. Search your provider logs for them. Wiz itself says it has no evidence linking those addresses directly to the platform breaches.
Rotate in Northflank's order
The order is Northflank's. For each key: revoke it at the provider, create a replacement, update the secret in Northflank (workload, secret group or global secret), and restart or redeploy whatever reads it.
AI provider keys. OpenAI, Anthropic, OpenRouter and the like: the keys customers reported abused. Revoke in each provider's dashboard, create a new key, and set a spend limit where the provider offers one.
Cloud provider credentials. AWS access keys, GCP service account keys and similar. Create the replacement, deploy it, then deactivate the old one, and check the cloud account's own audit log (CloudTrail on AWS) for calls made with it.
Payment provider keys. A Stripe secret key can create charges, issue refunds and read customer data; roll it with the shortest expiry you can deploy within, as in rotating a leaked Stripe key without breaking webhooks. Afterwards, a read-only scan such as Stripe Leak Check flags card-testing bursts, fraud warnings you can still refund and disabled webhook endpoints, and it needs only a read-only restricted key, not the secret key you just replaced.
Private keys. SSH deploy keys, signing keys, TLS keys, anything in PEM form. Generate a new pair, install the new public half where the old one was trusted, then remove the old one.
Database and other service credentials. For Northflank add-ons, use the secret rotation it enabled on Oct 30–31 (Postgres, MongoDB, MySQL, Redis, MinIO, RabbitMQ) and turn off public access on any add-on that doesn't need it. For databases hosted elsewhere, change the password in the database itself, then the secret. Then SMTP, analytics, error tracking and every other value in the list.
Want us to run it for you? The Ship Check Audit lists every key that ever left your server and confirms each old value now gets a 401 or 403: $149, within 48 hours.
Then sign in again and reconnect
Where it could, Northflank revoked its access tokens and sessions, VCS integrations, and cross-account IAM roles and service accounts. Its words: "If you haven't already, sign in again and reconnect your integrations."
Sign in to Northflank again, and create new Northflank API tokens for CI jobs and scripts that used the old ones.
Reconnect your version control integration (GitHub, GitLab, Bitbucket) and check that builds trigger again. On GitHub, review the security log and the installed apps and OAuth apps for anything you didn't add.
Reconnect cloud integrations (cross-account IAM roles, service accounts) and check the cloud account's audit log for activity by the old role or account you don't recognise.
Rotate the "integration secrets" Northflank mentions alongside project secrets: the credentials you gave it to connect registries, cloud accounts and other services, not only your app's environment variables.
Read Northflank's audit log (now on for every plan) for secret reads, deploys and logins you didn't make, and each provider's usage for calls you didn't make. Northflank hasn't said when the attacker's access began, only when the first alert came (Oct 30, 11:43 UTC), so read back as far as your logs go.
Not the only one this month
Wiz counts at least nine AI developer platforms that disclosed incidents in October 2026, Northflank last (Oct 30), and says the attacks were "explicitly hunting stored environment variables, with a focus on those granting AI access," with no single vulnerability linking them. If you also hosted on one of the others, see Railway env var disclosure: what to rotate and Zeabur is shutting down.
Ship Check Kit · $29
Rather not run it by hand?
The Ship Check Kit has your coding agent find every key that ever left the server (SC-SEC-01 for git history, SC-SEC-02 for the browser bundle) and then confirm each old value is actually revoked, not just replaced (SC-SEC-03, which fails while an old value still gets anything but a 401 or 403). Three of 44 launch checks, each with the evidence and the fix.
