Northflank Issues Urgent Warning Following Security Breach and Unauthorized AI API Key Use
Cloud application hosting platform Northflank is urging customers to immediately rotate all stored credentials and secrets after a security breach led to the unauthorized use of customer AI API keys. The company confirmed the incident on October 30, following a threat alert from cloud security firm Wiz.
BleepingComputer
Northflank, a cloud platform enabling developers to manage applications and AI services without managing underlying infrastructure, has issued an urgent warning to its customer base regarding a recent security incident.
The company disclosed the breach on October 30, advising users to rotate all environment variables and API keys. This warning followed a threat alert received from cloud security company Wiz, which Northflank engineers reviewed shortly after 11:43 UTC.
Northflank subsequently informed all users that they must assume their environment variables have been decrypted and that the secrets contained within them may have been stolen. The platform noted that applications commonly use these variables to store sensitive data, including database passwords, authentication tokens, and cloud service credentials.
In response to reports of unauthorized use of AI API keys supplied to the Northflank platform, the company has advised customers to review their AI provider usage and billing logs for any unexpected activity.
To mitigate the risk, Northflank implemented several immediate security measures. These included deploying network policy patches and enabling credential rotation for databases such as PostgreSQL, MongoDB, MySQL, and Redis. Furthermore, the company activated audit logs for all customers, including those on free accounts, to aid in investigations.
This breach occurs within a broader trend of attacks targeting AI development platforms. Wiz recently published a report titled "Black October for AI Developer Platforms," which identified at least nine security incidents affecting platforms including Northflank, Railway, and OpenCode.
Security researchers noted that attackers in these incidents specifically targeted environment variables containing AI service credentials, a practice known as LLMJacking. This technique involves using stolen credentials to access AI models, potentially generating massive API charges or allowing the stolen access to be resold.
Northflank continues to advise customers to rotate secrets stored in workloads, secret groups, and global secrets, and to disable public access to any enabled add-ons. The company has not yet disclosed the specific method by which attackers gained access to its systems or the total number of affected customers.