Northflank breach leads to abuse of customers' AI API keys
Original title: Northflank security breach leads to abuse of customers' AI API keys
Customers must assume environment variables were decrypted; Northflank has not said how attackers got in or how many were affected.
Cloud platform Northflank told customers on October 30 to rotate secrets after Wiz alerted it to a breach. It said environment variables should be assumed decrypted and later confirmed unauthorized use of AI API keys stored on the platform. Engineers applied network-policy patches the same day, enabled database credential rotation and audit logs, and still have not described the intrusion method or customer count.
Unconfirmed: Northflank has not disclosed the intrusion method, customer count, or whether credentials other than AI API keys were stolen; Wiz has not tied all nine October incidents to one actor.
- Wiz warned Northflank at 11:43 UTC on October 30; engineers reviewed it one minute later.
- Further patches followed at 12:50 UTC and 13:05 UTC, and Wiz incident response was requested.
- Credential rotation was enabled for PostgreSQL, MongoDB, MySQL, and Redis.
- Audit logs were enabled for all customers, including free accounts.
- Wiz cited about 2.5 million Bedrock calls and about $100,000 in charges in two other cases.
Impact: Customer secrets decrypted; AI API keys used without authorization
| Product | Affected |
|---|---|
| Northflank | — |
- 1.Rotate environment variables, API keys, workload secrets, secret groups, and global secrets.
- 2.Review AI provider usage and billing logs for unexpected activity.
- 3.Disable public access to add-ons where it is enabled.
- ATT&CK
- T1078 Valid Accounts
- Vendors
- Northflank
- Organizations
- WizRailwayOpenCodeWarpLightning AI
From the original article
3 min read at bleepingcomputer.com
Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.