Northflank breach leads to reported misuse of customers’ AI API keys
Summary
Northflank says multiple customers reported unauthorized use of AI API keys stored on its platform after a breach. It urged customers to rotate secrets; the access method and number of affected customers remain undisclosed.
Key points
- Northflank disclosed a security incident on October 30 after receiving a breach alert from Wiz.
- Northflank warned customers to assume environment variables had been decrypted and secrets stolen; multiple customers later reported unauthorized use of stored AI API keys.
- Northflank has not disclosed how attackers accessed its systems, how many customers were affected, or whether credentials beyond the reported AI API keys were abused or stolen.
- The company applied network policy patches and enabled credential rotation for PostgreSQL, MongoDB, MySQL, and Redis.
- Northflank enabled audit logs for all customers and advised rotating stored secrets, reviewing AI-provider usage and billing, and disabling public access to add-ons where enabled.
- Wiz reported at least nine incidents affecting AI development platforms during October and said some involved attempts to steal AI service credentials; it has not confirmed a common attacker across all incidents.
- Wiz describes LLMJacking as using stolen credentials to access AI models through another organization’s API keys, potentially generating charges or enabling resale of access.
Article Details
- Victim Organization
- Northflank
- Victim Domain
- Not disclosed
- Incident Type
- Security breach involving Northflank systems and reported unauthorized use of customers’ AI API keys.
- Incident Date
- 2026-10-30
- Disclosure Date
- 2026-10-30
- Data Types Exposed
- Environment variables and secrets; Northflank advised customers to assume these had been decrypted and stolen, but did not confirm whether they were accessed or stolen.
- AI API keys; multiple customers reported unauthorized use.
- Affected Records
- Not disclosed
- Affected Data Size
- Not disclosed
- Operational Impact
- Northflank issued network-policy and other patches, enabled credential rotation for PostgreSQL, MongoDB, MySQL, and Redis, and enabled audit logs for all customers. Customers were advised to rotate secrets and review AI-provider usage and billing logs. The article does not report a quantified financial impact for this incident.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed