Northflank is urging customers to replace secrets and credentials stored on its hosting platform after users reported unauthorized use of their AI API keys. The warning affects organizations and developers running applications, databases and AI services on Northflank.
In its latest incident-status update, posted Saturday, October 31, at 1:34 p.m. UTC, the company said secret rotation for MySQL and Redis was available to all customers. That is 6:34 a.m. Pacific. It again asked customers to rotate all secrets if they had not done so.
The company disclosed the incident October 30. Its precautionary guidance is to assume all environment variables have been compromised, including secrets in workloads, secret groups and global secrets. That instruction does not establish that every customer's credentials were stolen or used.
For customer-supplied credentials, Northflank says to revoke existing keys with the providers that issued them, generate replacements, and update the affected secrets and workloads on Northflank.
Customers should also review usage and billing records at their AI providers for unexpected activity, then report suspicious use to both Northflank support and the relevant provider. Northflank says it has enabled audit logs for all customers, including free users. It also recommends disabling public access to database add-ons where customers have enabled it.
BleepingComputer reported Saturday that the company had not disclosed the entry method or how many customers were affected. Its report explains that environment variables can contain database passwords, cloud credentials and authentication tokens, extending the potential consequences beyond AI-service bills.
The status page still labels the incident Identified rather than Resolved. Northflank's guidance covers secrets across the platform; customers should follow the instructions for their specific database or workload when replacing them.
