Northflank update: attack contained within an hour and no sign workloads were accessed, tokens and sessions revoked
Northflank said in a November 2, 2026 update that the October 30 attack on its control plane was contained within an hour of the first alert, that it found no sign the attacker remained in its systems or that running workloads or their data were accessed, and that it has revoked tokens, sessions and some integrations; the root cause is still to come.
What happened
We first flagged this on October 30, 2026 — here’s what changed. Update Nov 2, 2026: Added Northflank’s November 2 status update — containment within an hour of the first alert, no sign the attacker remained in its environment or that workloads or their data were accessed, revoked tokens, sessions and some integrations, and an exclusion for customers on dedicated control planes. In the update, Northflank said it believes the attack vector was contained within an hour of the first alert from security firm Wiz, which arrived at 11:43 UTC on October 30, and that its investigation shows no sign the attacker was in its environment after the attack. It said the evidence suggests the attack focused on secrets held in its control plane, that running workloads were unaffected, and that it has seen no sign workloads or workload data were accessed. It also revoked tokens, sessions and some integrations, so users must sign in again and reconnect them. The root cause is still not published: Northflank says it will share a root cause analysis once findings are confirmed, and independent forensic auditors are still reviewing the attack.
Who is affected
The same customers as in the original report — everyone Northflank told on October 30 to assume their stored environment variables had been decrypted and to rotate every secret — with one narrowing in this update: customers on forward-deployed or dedicated control planes are unaffected, Northflank says. The rotation advice is unchanged and now has a stated order: start with AI provider keys, then review provider logs and billing for unexpected usage or spend, and contact the provider directly if you see any. Northflank has still not said how many customers were affected or how the attacker got in.
How serious
The containment claims, if they hold, limit the window in which secrets could be taken — but they do not undo the original exposure. Any secret the attacker copied during that window stays valid until it is rotated at the issuing provider, and users had already reported unauthorised use of AI API keys stored on the platform, which is how stolen keys turn into someone else’s AI bill. The revoked sessions and tokens cut off ongoing access through Northflank itself; they do not protect a key that was already taken and is used directly with its provider. Treat the update as the company’s current position while its investigation and the independent forensic review continue — the root cause analysis is the document that will confirm or revise it.
What to do now
If you have not finished rotating, finish it: revoke each old credential with its issuing provider, generate a replacement, then update the secret in your workloads, secret groups and global secrets — starting with AI provider keys and payment keys, then database and cloud credentials. Review AI provider usage and billing logs for unexpected activity and report anything suspicious to Northflank and to the provider. Sign in again and reconnect the integrations Northflank revoked, and turn off public access on add-ons (its managed databases and services) where you had it enabled. Audit logs are now enabled for all customers, including free accounts, if you need them for your own review.
Sources: Northflank status page, “Security incident” (updates October 30 – November 2, 2026) · teiss, November 2, 2026 · Original report: Northflank breach (October 30, 2026)