Northflank breach exposes customer AI API keys, prompting mandatory secret rotation

Northflank, a cloud‑hosting platform for developers, announced a security breach that exposed customers’ AI API keys, forcing an immediate rotation of all secrets to prevent further abuse.

What happened

The incident was discovered when unusual activity was detected on several AI service accounts linked to Northflank users. Investigation revealed that attackers had accessed stored API credentials for services such as OpenAI and Anthropic, allowing them to run unauthorized queries and consume quota.

Scope of the breach

Northflank confirmed that the breach affected a subset of its customers who stored AI keys in the platform’s secret management feature. The company did not disclose the exact number of impacted accounts, but emphasized that no other data, such as passwords or personal information, was compromised.

The exposed keys were used to generate text, images, and code, leading to increased costs for the affected users and potential misuse of the AI models for malicious purposes.

Response and remediation

Immediately after confirming the breach, Northflank issued a mandatory secret rotation, advising all users to revoke existing AI API keys and generate new ones. The platform also rolled out additional encryption controls and audit logging to detect future unauthorized access.

• Revoke compromised API keys on the AI provider’s dashboard
• Generate new keys and store them using Northflank’s updated secret manager
• Enable two‑factor authentication for all accounts
• Monitor usage logs for anomalous activity

Customers are encouraged to review their usage reports for unexpected spikes and to contact Northflank support if they suspect further exploitation.

For ongoing best practices on securing cloud‑based AI integrations, see the Infrastructure coverage on uxc.news.

BleepingComputer coverage of Northflank security breach

Track coverage on Momentum · More in Infrastructure.