Northflank Tells Users to Rotate All Secrets After a Breach

Northflank told customers Friday to replace every secret stored on its platform after a security breach, and some customers’ AI API keys were used without authorization.

Users were told to treat all environment variables as if they had been decrypted. Applications read these settings while running, and they commonly hold database passwords, cloud credentials and API keys.

Northflank’s instructions call for revoking old credentials with their issuers, generating replacements and updating them in workloads, secret groups and global secrets. The company also directed users to review AI service usage and bills for unusual activity and disable public access to add-ons such as databases.

Northflank did not disclose how attackers gained access or how many customers were affected. Founded in 2019, the UK-based company helps teams deploy applications, databases and AI agents without managing servers themselves.

Audit logs, which record who took actions and when, became available to all customers, including free users, on Oct. 31.