On October 30, 2026, cloud platform-as-a-service provider Northflank disclosed a major security incident in which all customer environment variables — including secrets, API keys, and database credentials — appear to have been decrypted and exposed. The breach timeline is tight: Wiz issued a threat alert at 11:43 UTC, Northflank engineers reviewed it one minute later, and initial network patches were deployed by 12:02 UTC. But the damage was already done. Multiple users have confirmed unauthorized usage of their AI provider API keys stored within Northflank. The company's guidance is blunt and escalating: assume all environment variables are compromised. Rotate everything — workload secrets, secret groups, global secrets. Disable public access to database addons. This is not a precautionary measure; it is triage after confirmed exploitation. Northflank links the incident to the broader pattern documented in Wiz's "Black October" report, noting that similar IP addresses appear in both their incident and the Wiz findings. This positions the Northflank breach not as an isolated failure but as one node in a coordinated campaign targeting AI credentials across cloud infrastructure providers. The attackers are harvesting API keys for large language model providers — OpenAI, Anthropic, Google — and running up usage on stolen accounts. The platform's incident response included enabling Postgres and MongoDB secret rotation for all users by 3:12 PM UTC and activating audit logs for all customers, including free-tier users, by 1:04 AM on October 31. But the core architectural question remains unanswered: how were environment variables decrypted in the first place? Northflank's updates carefully state "our investigation is ongoing" and "no further confirmed findings to share," which means the root cause — whether a key management failure, a vulnerability in their secrets engine, or a supply-chain compromise — is either unknown or undisclosed. The extraction pattern here is classic cloud-era risk transfer. Northflank's value proposition is managing infrastructure complexity so developers don't have to. Customers entrusted their most sensitive credentials — database passwords, AI API keys, payment processor tokens — to a platform whose encryption-at-rest guarantees have now been falsified. The cost of the breach is borne almost entirely by downstream customers: they must rotate every credential, audit every provider, and absorb whatever charges attackers racked up on their AI accounts. The "Black October" framing matters. If Wiz's assessment is correct that this is a coordinated campaign, Northflank is a symptom, not the disease. The real structural problem is that the cloud PaaS model concentrates secrets from thousands of organizations into single targets. Break one platform's key management, and you get a master key to thousands of AI accounts simultaneously. The attackers understood this leverage better than the defenders did. For Northflank as a company, the survival question is trust. Their entire product is "we manage your infrastructure securely." A breach that decrypts all customer secrets is an existential event for that promise. Whether they recover depends entirely on the root-cause disclosure and whether the architecture gets rebuilt, not patched.
