The Northflank platform breach — customers told to assume all stored secrets were decrypted and rotate them — and the containment update that followed.
Latest: Northflank update: attack contained within an hour and no sign workloads were accessed, tokens and sessions revoked (disclosed 2026-11-02)
Northflank said the October 30 attack on its control plane was contained within an hour of the first alert, that it found no sign the attacker remained or that running workloads or their data were accessed, and that it has revoked tokens, sessions and some integrations — follow-up to our October 30 report.
Northflank disclosed a security incident on October 30 and told all customers to assume their environment variables had been decrypted and rotate every stored secret immediately, after users reported unauthorised use of AI API keys stored on the platform; no root cause or affected count has been given.