Northflank Breach Exposes Customer AI API Keys via Stolen Environment Variables
What Happened — On 30 October 2026 the cloud‑application‑hosting platform Northflank disclosed that attackers had accessed and decrypted customers’ environment variables. The breach was first flagged by cloud‑security firm Wiz, and Northflank responded with network‑policy patches and a request for customers to rotate all stored secrets. Multiple customers subsequently reported unauthorized use of their AI provider API keys that had been stored as environment variables on the platform. Northflank has not revealed how the attackers initially gained access, nor the total number of affected accounts, but it has enabled audit logging for all users and is urging immediate rotation of credentials, database passwords, and any other secrets.
Why It Matters for Trust & Control Assurance — The incident highlights the need for robust secret‑management controls and continuous monitoring of credential use.
Who Is Affected — SaaS developers and enterprises that host applications, containers, databases, or AI workloads on Northflank’s platform.
Recommended Actions
- Rotate every environment variable, API key, and database credential immediately.
- Enable and review audit logs for anomalous secret usage.
- Implement automated secret‑scanning and rotation tooling.
- Adopt a zero‑trust approach to secret storage (e.g., vault solutions, short‑lived tokens).
- Document the incident response and evidence collection for audit readiness.
Source: BleepingComputer
Technical Notes
- Attack vector: unknown; breach manifested as decryption of stored environment variables.
- Exposed data: API keys for AI services (e.g., OpenAI, Anthropic), database passwords, cloud‑service tokens.
- No public CVE; the issue is a credential‑exposure incident rather than a software flaw.
Source: same as above