Northflank Urges Secret Rotation After Customers Report AI API Key Abuse
The cloud platform says the attack appears contained, but customers still need to replace credentials and investigate unexpected usage.
Northflank has issued a fresh update following its security incident, saying on 2 November 2026 that it believes the attack vector was contained within an hour of the initial alert. Independent forensic specialists are reviewing the incident, and the company says evidence points to secrets held in its control plane. It has seen no indication that attackers accessed workloads or workload data. Customers using forward-deployed or dedicated control planes are unaffected, according to the provider.
The incident was disclosed on 30 October. Customers subsequently reported unauthorised use of AI credentials stored on the platform. Northflank continues to urge rotation of integration and project secrets, even where customers have noticed nothing suspicious, alongside checks of provider activity and billing records. It intends to publish a root cause analysis once findings are confirmed.
For customers, containment at the hosting provider does not automatically settle the problem. A credential copied during an intrusion may still provide access elsewhere until it is revoked. The practical response therefore extends beyond checking whether an application is running.
A customer disclosure from Quiltt illustrates that distinction. The company said its customer-facing traffic ran on other hosting providers, but background workers on Northflank held production database and Redis credentials. Quiltt reported rotating every exposed credential. Its review of database, network, application and job-queue logs found no evidence of unauthorised access to customer data, and customer-facing services were not interrupted.
The Customer Success lesson is straightforward: an available service and a completed customer response are different milestones. Customers need clear ownership of credential replacement, help identifying connected services, and updates that distinguish confirmed findings from questions still under investigation.
For account teams, a useful follow-up is more specific than “Have you seen the advisory?” It asks whether the customer has identified affected integrations, revoked old credentials, checked unexpected activity and recorded any remaining actions.
Northflank’s investigation is continuing. The immediate priority for affected customers is to complete those checks while watching for the provider’s confirmed findings, not to treat the absence of an outage as proof that no action is needed.
Follow-up links
0 comments
No comments yet. Be the first to comment.