Northflank has warned customers to replace credentials after users reported unauthorized use of AI-service keys stored on its platform. The company opened audit logs to all accounts and expanded database credential rotation during its response. Its warning to assume secrets were exposed is precautionary; the number of affected customers and the full extent of access remained undisclosed.
Northflank, a cloud platform for deploying applications and databases, warned customers after users reported unauthorized use of AI service keys stored on the platform. The updates from Northflank asked customers to revoke existing credentials with their providers, generate replacements and update affected applications. The company also advised checking AI provider usage and billing logs for unexpected activity.[1], [2]
On October 31, Northflank opened audit logs to every account, including free users. Another update that day made MySQL and Redis credential rotation available to all customers. These measures extended customers’ ability to investigate activity and replace database credentials while the incident response continued. Suspicious usage could be reported to both Northflank and the relevant provider.[1], [2]
The precaution covered secrets in workloads, secret groups and global settings, with customers told to assume exposure. Reports of AI-key misuse established a narrower observed effect. Northflank had not disclosed the number of affected customers or a completed explanation of how access was gained. The company continued recommending replacement of secrets and disabling public access to add-ons where enabled.[1], [2]
