Northflank told all users to rotate secrets on October 30, 2026, warning that they should assume their environment variables had been decrypted. The cloud platform's 15:12 UTC incident update also says multiple users reported their AI keys had been used. The notice does not identify an attacker or explain the initial access route.
The instruction covers secrets on workloads, secret groups and global secrets. Northflank says it enabled secret rotation for Postgres and MongoDB for all users and recommends disabling public access on addons where it is enabled. These are the company's incident-response instructions, not a finding that every customer's credentials were used.
Replacement credentials need a completed rotation
Northflank's addon rotation API documentation describes a detail worth checking during recovery: starting a rotation creates credentials with the same permissions, while the old credentials remain valid until the rotation is finalised. Creating a replacement therefore leaves a further step before the old login stops working.
Applications also need to receive the changed values. The secret-group documentation says services and jobs inherit runtime variables or build arguments from these groups. After editing a group, the dashboard's restart dependents control redeploys the services and jobs that inherit its secrets with the new values. This reporting follows the documentation; MrKeyoor has not tested rotation in a customer account.
For teams scripting those updates, the same documentation warns that sending secrets.variables or secrets.files replaces the entire corresponding collection, even with a PATCH request. To change one variable, it instructs callers to read the group, merge the change and send the complete set back. A rushed partial update could otherwise remove unrelated configuration.
The cause and exposure window remain unanswered
The incident timeline starts with a Wiz threat alert at 11:43 UTC and records an initial network-policy patch at 12:02 UTC. Those response times do not establish when access began. A follow-up needs to explain the exposure window and how the attacker obtained access, so customers can judge what else requires investigation.