What happened
Northflank, a cloud platform for deploying applications, containers, databases and AI workloads, disclosed a security incident on 30 October and told customers to rotate everything stored on it. The instruction was blunt: assume all environment variables have been decrypted, disable and rotate all keys.
The trigger came from outside. Wiz raised a threat alert at 11:43 UTC on 30 October, Northflank engineers reviewed it a minute later, and the company applied a network policy patch, followed by further patches at 12:50 UTC and 13:05 UTC. Northflank also asked Wiz's incident response team for help.
Environment variables are where applications keep database passwords, cloud credentials, authentication tokens and API keys. Once decrypted, those secrets work anywhere they are accepted. Northflank later confirmed that multiple customers had reported unauthorised use of AI API keys supplied to the platform, and advised reviewing AI provider usage and billing logs for unexpected activity.
The company has not said how the attackers got in, how many customers were affected, or whether anything beyond the reported AI keys was taken. It did enable credential rotation for PostgreSQL, MongoDB, MySQL and Redis, and switched on audit logs for all customers including free accounts. Customers were also told to rotate secrets held in workloads, secret groups and global secrets, and to turn off public access to add ons where it had been enabled.
Why this is a GRC story
Secrets in a platform are a shared control. A hosting provider that stores customer API keys has taken on part of the customer's key management, and that is a concentration of risk which belongs in the third party register with a named owner, not only in a dependency list.
Rotation is only as good as the inventory. The customers who came out of this well are the ones who could name every secret they had stored and rotate it within hours. Anyone relying on memory or a wiki page spent the first day compiling a list. A secrets inventory with owners and rotation dates is cheap to maintain and impossible to improvise.
Audit logs switching on mid incident is a finding. Logging was enabled for all customers during the response. That was the right call, but it means the evidence customers need for their own investigation exists only from that moment forward. Logging should be a default on paid and free tiers alike, with retention stated in the contract.
API key abuse is a financial control issue. Unauthorised AI API usage turns a confidentiality incident into a billing incident. Rate limits, spend caps and anomaly alerts with the provider are detective controls that catch stolen keys before the invoice does.
What to watch
Watch the incident write up for the initial access path, and whether Northflank publishes a scope figure rather than a description. Watch the free tier question as well, since free accounts rarely get the same monitoring and were switched on for audit logs only after the fact. For teams using any hosting platform, the practical test this week is simple: can you list every secret you have stored with a third party, and name who rotates it.
Attribution: Analysis based on BleepingComputer and related public reporting. This article is original commentary, not a repost of the source material.