Cloud-application hosting platform Northflank told customers to assume all environment variables had been decrypted after a security breach that led to unauthorised use of AI API keys stored on the platform. The company disclosed the incident on 30 October after receiving a threat alert from cloud-security vendor Wiz at 11:43 UTC, which its engineers reviewed a minute later; it applied network-policy patches at 12:50 and 13:05 UTC and called in Wiz's incident-response team. Northflank warned customers to "disable/rotate all keys," enabled credential rotation for PostgreSQL, MongoDB, MySQL and Redis, and turned on audit logs for every account including free tiers. It later confirmed that multiple customers reported unauthorised use of AI API keys supplied to the platform and advised reviewing AI-provider usage and billing logs. Northflank has not disclosed how attackers gained access, how many customers were affected, or whether credentials beyond AI API keys were abused. Environment variables commonly hold database passwords, cloud credentials, authentication tokens and API keys, so the blast radius can extend well past the platform itself.

• Source article