Northflank security incident: PaaS tells users to assume all environment variables were decrypted
Northflank (PaaS)
Northflank, a platform-as-a-service for deploying apps and databases, declared a security incident with a major outage across 7 platform components on Oct 30 2026. Its status page says a Wiz threat alert fired at 11:43 UTC, engineers reviewed it a minute later, and Northflank deployed an initial network policy patch at 12:02 UTC with more patches at 12:50 and 13:05 UTC, then requested Wiz CIRT support at 13:00 UTC. At 13:40 UTC it told users to rotate environment variables immediately, and at 13:58 UTC it said to "assume all environment variables have been decrypted" and to disable or rotate all keys. At 15:12 UTC it added that multiple users are confirming their AI keys have been used, and that secrets on workloads, secret groups and global secrets are all covered. Northflank has not yet said how the attacker got in or how many customers are affected.
Why this severity: Northflank tells every customer to assume their environment variables were decrypted; cause and scope not yet disclosed
- Started
- Oct 30, 2026
Affected
- Northflank platform (all environment variables stored on Northflank)
Fixed in
No fixed release yet
Timeline4
11:43 UTC: a Wiz threat alert fires; Northflank deploys a network policy patch at 12:02 UTC and more patches at 12:50 and 13:05 UTC, and asks Wiz CIRT for help at 13:00 UTC.
13:40 UTC: Northflank opens a security incident with a major outage and tells users to rotate environment variables immediately.
13:58 UTC: Northflank marks the incident identified and says to assume all environment variables have been decrypted and to disable or rotate all keys.
15:12 UTC: Northflank says all users should assume their environment variables are decrypted and start rotating immediately, covering secrets on workloads, secret groups and global secrets, and that multiple users are confirming their AI keys have been used.
Advisories1
News & write-ups2
Get an email when a new major security incident drops. No spam, unsubscribe any time.
