Cloud hosting platform Northflank disclosed a security incident on October 30 after a threat alert from an outside security firm. It told customers to assume all environment variables had been decrypted and disable or rotate every key.
Several users reported unauthorized use of AI API keys stored on the platform. The affected customer count, entry point, and any theft or misuse of other credentials remain undisclosed. Northflank has provided database secret rotation and audit logs for all customers, including free users.
Environment variables often hold database passwords, cloud credentials, authentication tokens and API keys. Exposure can lead to breaches at other services, data theft or unauthorized API charges. Using stolen AI keys to run models on someone else's account and generate charges is known as LLMjacking.
If you use Northflank, replace every stored secret: revoke old keys with each provider, issue new ones and update your workloads. Review AI providers' usage and billing logs. Report suspicious use to Northflank support and the relevant provider, and disable public access to add-ons.
Image: AI-generated
