Northflank security breach leads to abuse of customers' AI API keys

Northflank, a cloud application hosting platform, suffered a security breach resulting in the unauthorized decryption and theft of customers' environment variables, including AI API keys. The company warned all customers to immediately rotate stored credentials following a threat alert from Wiz. Multiple customers reported abuse of their AI API keys, with attackers potentially leveraging the stolen credentials for 'LLMJacking'—exploiting access to run up costly AI service usage. The breach is part of a broader wave of attacks on AI development platforms observed in October 2026, collectively dubbed 'Black October' by Wiz.

AI-extracted · verify before operational use