--- title: Northflank security breach leads to abuse of customers'... description: Cloud hosting platform Northflank suffered a security breach that let attackers abuse customers' stored AI API keys. Northflank disclosed the incident on... canonical: https://daily.dev/posts/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys-qtovz9klg twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Northflank security breach leads to abuse of customers' AI API keys | daily.dev og:description: Cloud hosting platform Northflank suffered a security breach that let attackers abuse customers' stored AI API keys. Northflank disclosed the incident on... og:url: https://daily.dev/posts/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys-qtovz9klg og:image: https://api.daily.dev/og/posts/qTOvz9kLG.png og:image:alt: Northflank security breach leads to abuse of customers' AI API keys og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Northflank security breach leads to abuse of customers' AI API keys **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 4 min read · 0 upvotes · 0 comments ## Summary Cloud hosting platform Northflank suffered a security breach that let attackers abuse customers' stored AI API keys. Northflank disclosed the incident on October 30 after a threat alert from Wiz, telling customers to assume all environment variables were decrypted and to rotate every key and secret immediately. Multiple customers reported unauthorized AI API key usage. Northflank has since enabled credential rotation for PostgreSQL, MongoDB, MySQL and Redis, and turned on audit logs for all accounts, including free tiers. Wiz says Northflank is one of at least nine AI developer platforms hit in a wave of October incidents, including Railway, OpenCode, Warp and Lightning AI; some of these incidents involved attempts to steal AI API keys, and in two cases Wiz investigated, stolen credentials were used to make about 2.5 million Amazon Bedrock API calls worth roughly $100,000. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What should I do if I store API keys as environment variables on Northflank? Rotate all credentials and secrets stored on the platform immediately. Northflank told customers to assume all environment variables had been decrypted after a breach disclosed on October 30, and it has enabled credential rotation for PostgreSQL, MongoDB, MySQL, and Redis, plus audit logs for all accounts including free tiers. _daily.dev surfaces breach disclosures like this so you catch credential rotation deadlines before attackers do._ ### What is LLMJacking and why are attackers targeting AI API keys? LLMJacking is the practice of using stolen credentials to access AI models under another organization's account, generating large API charges or reselling the stolen access. Wiz investigated cases where compromised enterprise credentials were used to make about 2.5 million Amazon Bedrock API calls, generating roughly $100,000 in AI usage. _Teams relying on AI APIs track emerging abuse patterns like this through daily.dev to secure their credentials._ ### Which AI developer platforms had security breaches around October 30? Wiz identified at least nine security incidents affecting AI development platforms in a single month, including Northflank, Railway, OpenCode, Warp, and Lightning AI. Railway's breach also potentially exposed decrypted environment variables, OpenCode disclosed exposed AI API keys, and Warp reported exposure of AI agent logs and user telemetry data. _Developers choosing an AI hosting platform weigh incidents like these, tracked on daily.dev, before trusting it with secrets._ ## Similar posts on daily.dev - [AI evaluation startup Braintrust confirms breach, tells every customer to rotate sensitive keys](https://daily.dev/posts/ai-evaluation-startup-braintrust-confirms-breach-tells-every-customer-to-rotate-sensitive-keys-dli5x1hcn) · TechCrunch · 1 upvotes · 0 comments - [Preliminary Report: Oct 21st Security Incident](https://daily.dev/posts/preliminary-report-oct-21st-security-incident-9lrevx8xo) · Railway Blog · 0 upvotes · 0 comments - [15 Malicious JetBrains Plugins Stole AI API Keys from 70,000 Developers](https://daily.dev/posts/15-malicious-jetbrains-plugins-stole-ai-api-keys-from-70-000-developers-hledivprv) · StepSecurity · 17 upvotes · 5 comments --- Tags: [#security](https://daily.dev/tags/security), [#data-breach](https://daily.dev/tags/data-breach) [View this post on daily.dev](https://daily.dev/posts/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys-qtovz9klg) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Northflank security breach leads to abuse of customers' AI API keys","url":"https://daily.dev/posts/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys-qtovz9klg","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys-qtovz9klg"},"datePublished":"2026-10-31T18:03:12.553Z","dateModified":"2026-10-31T20:55:14.317Z","description":"Cloud hosting platform Northflank suffered a security breach that let attackers abuse customers' stored AI API keys. Northflank disclosed the incident on...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/938889e37f6f5999e4b22a3ec4dc29dc?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/938889e37f6f5999e4b22a3ec4dc29dc?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys-qtovz9klg","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,data-breach","timeRequired":"PT4M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Northflank security breach leads to abuse of customers' AI API keys"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/northflank-security-breach-leads-to-abuse-of-customers-ai-api-keys-qtovz9klg#faq","mainEntity":[{"@type":"Question","name":"What should I do if I store API keys as environment variables on Northflank?","acceptedAnswer":{"@type":"Answer","text":"Rotate all credentials and secrets stored on the platform immediately. Northflank told customers to assume all environment variables had been decrypted after a breach disclosed on October 30, and it has enabled credential rotation for PostgreSQL, MongoDB, MySQL, and Redis, plus audit logs for all accounts including free tiers. daily.dev surfaces breach disclosures like this so you catch credential rotation deadlines before attackers do."}},{"@type":"Question","name":"What is LLMJacking and why are attackers targeting AI API keys?","acceptedAnswer":{"@type":"Answer","text":"LLMJacking is the practice of using stolen credentials to access AI models under another organization's account, generating large API charges or reselling the stolen access. Wiz investigated cases where compromised enterprise credentials were used to make about 2.5 million Amazon Bedrock API calls, generating roughly $100,000 in AI usage. Teams relying on AI APIs track emerging abuse patterns like this through daily.dev to secure their credentials."}},{"@type":"Question","name":"Which AI developer platforms had security breaches around October 30?","acceptedAnswer":{"@type":"Answer","text":"Wiz identified at least nine security incidents affecting AI development platforms in a single month, including Northflank, Railway, OpenCode, Warp, and Lightning AI. Railway's breach also potentially exposed decrypted environment variables, OpenCode disclosed exposed AI API keys, and Warp reported exposure of AI agent logs and user telemetry data. Developers choosing an AI hosting platform weigh incidents like these, tracked on daily.dev, before trusting it with secrets."}}]} ```