Northflank Urges Users to Rotate API Keys Following Security Breach

ANKARA, Nov 1 (OPA) — Northflank confirmed the breach on October 30 after receiving a warning from Wiz at 11:43 UTC. Engineering teams initiated a response within one minute, deploying network policy patches by 13:05 UTC. Despite the rapid response, the company has advised all users to treat their existing environment variables as compromised, necessitating a full rotation of credentials, including database passwords and API keys.

The breach has specifically impacted AI services, with multiple customers reporting unauthorized use of their API keys. These keys function as digital credentials for services like OpenAI; their theft allows attackers to execute calls at the expense of the account holder. This technique, known as LLMJacking, has become a growing threat, with recent reports indicating that attackers have generated millions of unauthorized API calls, resulting in significant financial liabilities for affected organizations.

This incident is part of a broader trend identified by Wiz in its 'Black October' report, which documented at least nine separate security events targeting AI development platforms throughout the month. Other affected entities include Railway, OpenCode, Warp, and Lightning AI. While the specific entry point for the Northflank breach remains under investigation, the company has enabled credential rotation features for PostgreSQL, MongoDB, MySQL, and Redis to mitigate further exposure.

Northflank has activated audit logs for all accounts, including free tiers, to allow users to monitor for suspicious activity. The company continues to recommend that users disable public access to plugins and review billing records for unauthorized usage. Officials have yet to disclose the total number of affected customers or confirm if data beyond AI service keys was accessed during the intrusion.