Northflank Alerts Customers After Security Breach Exposes AI API Keys

Cloud application hosting platform Northflank has issued a warning to its customers to rotate all credentials and secrets stored on its platform after a security breach resulted in unauthorized use of customers' AI API keys. The company made this disclosure on October 30, following a threat alert from cloud security firm Wiz.

In its announcement, Northflank advised customers to assume that their environment variables had been decrypted and that the sensitive information contained within them had been compromised. The company emphasized the urgency of the situation, stating, "Assume all environment variables have been decrypted. Disable/rotate all keys." Environment variables are commonly used in applications to store sensitive data such as database passwords and API keys.

After the breach, Northflank confirmed that multiple customers reported unauthorized use of their AI API keys. The company urged users to review their AI provider usage and billing logs for any unexpected activity and to report any suspicious usage to both Northflank and their AI providers.

According to Northflank's incident timeline, Wiz alerted them to the breach at 11:43 UTC on October 30, and the company's engineers began reviewing the situation immediately. Northflank responded quickly, implementing a network policy patch and additional security measures shortly thereafter. However, the company has not disclosed how the attackers gained access to its systems or the total number of affected customers.

Northflank's Enhanced Security Measures

As part of its response to the breach, Northflank enabled credential rotation for various database services, including PostgreSQL, MongoDB, MySQL, and Redis. The company also activated audit logs for all customers, including those on free accounts, to assist in investigating any suspicious activities.

The breach highlights a growing trend of attacks targeting AI development platforms, which are seen as valuable targets due to the sensitive API keys they store. A report from Wiz titled "Black October for AI Developer Platforms" identified at least nine security incidents affecting such platforms in October, including Northflank and others like Railway and OpenCode.

Intelligence Reviewed

Wiz noted that attackers have specifically targeted environment variables containing AI service credentials, a practice known as LLMJacking. This method allows stolen credentials to be used to access AI models via another organization's API keys, potentially leading to significant financial losses.

Northflank has continued to advise its customers to rotate any secrets stored in their workloads and to disable public access to add-ons where applicable. The company is working to ensure that its customers are aware of the risks and are taking the necessary steps to secure their accounts.