INSPECTING ARCHIVED INTELLIGENCE (OUTDATED VERSION).

Northflank's AI API compromised by malicious actors in security breach

| 2026-10-31 18:01 LOW LOW DATA BREACH
JSON
Executive Summary
AI-generated
A security breach occurred on October 30, 2026, when Northflank, a cloud application hosting platform, warned customers to immediately rotate their environment variables and API keys after receiving a threat alert from Wiz. Multiple customers had reported unauthorized use of AI API keys stored on the platform, with users advised to review their AI provider usage and billing logs for unexpected activity. The attackers gained access to Northflank's systems without disclosing how they did so, affecting an unknown number of customers, who were also informed that their secrets stored within environment variables may have been stolen. As part of its response, the company enabled credential rotation for several databases and audit logs for all customers, advising them to disable public access to add-ons where enabled.
Technical Mitigations AI-generated
• Rotate all environment variables and API keys stored on the Northflank platform immediately. • Enable audit logs for all customers, including those using free accounts, to help them investigate any suspicious activity. • Disable public access to add-ons where enabled to prevent unauthorized use of AI API keys.
Intelligence Metadata
Actors / Malware / CVEs / Campaigns
Target & Sectors
Global Scope technologytechnology
Incident Timeline
‎October 30
Threat actors exploited Northflank's AI API keys after receiving a threat alert from cloud security company Wiz on October 30.
organisation API
The company disclosed a security incident on October 30, warning customers to immediately rotate their environment variables and API keys after receiving a threat alert from cloud security company Wiz.
organisation UTC
According to Northflank's published incident timeline, Wiz warned them about the breach at 11:43 UTC on October 30, which the company's engineers reviewed one minute later.
‎2026/10/31
Northflank's security breach led to the unauthorized use of approximately 2.5 million Amazon Bedrock API calls by compromised enterprise credentials, generating around $100,000 in AI usage.
organisation Adaptive Security's
Adaptive Security's AI agents analyze email intent, context, and behavior to uncover phishing, business email compromise, and invoice fraud.
organisation Microsoft 365
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
organisation Google Workspace
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
organisation Northflank
Northflank security breach leads to abuse of customers' AI API keys.
organisation Northflank later
Northflank later confirmed that multiple customers had reported unauthorized use of AI API keys stored on the platform.
organisation Wiz
The company also requested assistance from Wiz's incident response team.
organisation BleepingComputer
BleepingComputer contacted Northflank with questions about the breach, its impact on customers, and whether stored credentials were accessed or stolen, but has not received a response.
organisation AI Developer Platforms
In a report titled " Black October for AI Developer Platforms ," Wiz identified at least nine security incidents affecting AI development platforms during the month, including Northflank, Railway , OpenCode , Warp , and Lightning AI.
organisation OpenCode
The Railway incident also involved potential exposure of decrypted customer environment variables, while OpenCode disclosed exposed AI API keys.
financial $100,000 calls
In two cases investigated by Wiz, compromised enterprise credentials were used to make approximately 2.5 million Amazon Bedrock API calls, generating approximately $100,000 in AI usage.
Tactical Metrics
Metrics
infrastructure
‎Microsoft 365
Affected Product
See what's getting through with a 14-day read-only scan of Microsoft 365 or Google Workspace, with no MX changes.
Metrics
financial
100,000
Financial Impact / Stolen Funds
In two cases investigated by Wiz, compromised enterprise credentials were used to make approximately 2.5 million Amazon Bedrock API calls, generating approximately $100,000 in AI usage.
Intelligence Sources
BleepingComputer 2026-10-31