# Northflank Platform Security Breach and Outage Critical security incident forces immediate credential rotation for all platform users. - **Source:** [Hacker News (news.ycombinator.com)](https://brifing.si/source/13c923cd-6d99-442b-9b8b-1181f4d8cd91) - **Published:** 2026-10-30 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/44f313c6-2c3b-477b-b1d8-c328ff9814df ## Security Incident Identified Northflank confirmed a major security incident on October 30, 2026, causing significant platform outages. The investigation remains ongoing as engineers work to contain the breach. Users are currently advised to assume all environment variables were compromised during the unauthorized access event, necessitating an immediate and comprehensive security response across all active workloads. ## Immediate Credential Rotation Required The platform guidance mandates that all users rotate secrets and credentials immediately. This requirement covers workloads, secret groups, and global secrets. Because environment variables are assumed to be decrypted, the risk extends to any sensitive data stored within those configurations. Users must treat all existing keys as potentially exposed to malicious actors. ## Addon and Database Security Northflank has enabled automatic secret rotation for Postgres and MongoDB databases for all users. Furthermore, the company strongly recommends disabling public access to any addons where such exposure was previously enabled. These measures aim to mitigate further unauthorized access while the team continues to investigate the full extent of the platform compromise. ## AI Key Misuse Confirmed Multiple users have reported that their AI keys were actively used by unauthorized parties following the breach. This confirmation highlights the severity of the incident, as attackers are leveraging exposed credentials for external services. Users must prioritize the immediate revocation and rotation of all API keys associated with AI-driven integrations and services. ## Network Policy Patching Efforts Technical teams deployed an initial network policy patch at 12:02 UTC, followed by additional patching at 12:50 UTC. These rapid interventions are part of the ongoing effort to secure the infrastructure. Despite these patches, the platform remains in a state of major outage, affecting critical components like networking, builds, logs, and metrics. ## Platform Component Status The Northflank platform is experiencing a major outage across seven core components, resulting in 99.66% uptime for the affected services. While the Northflank App maintains 99.82% uptime, the API and marketing site remain operational at 100%. Users should monitor the status page for further updates as the investigation into the breach progresses. ## Operational Impact and Scope The breach has severely disrupted core development workflows, specifically impacting build processes and system observability through logs and metrics. These outages prevent teams from deploying new code or monitoring existing production environments effectively. The combination of credential exposure and infrastructure instability creates a high-pressure recovery scenario for all affected platform customers. ## Strategic Security Implications This incident underscores the critical vulnerability of centralized environment variables in cloud-native platforms. When a provider is compromised, the blast radius includes all customer-managed secrets. Moving forward, organizations must evaluate their reliance on platform-specific secret management and consider implementing more robust, decentralized security architectures to protect against similar large-scale infrastructure breaches. ## Sources covering this story - https://status.northflank.com — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._