Server racks in a data center, shown for illustration. Carl Lender / Wikimedia Commons, CC BY 2.0.
Northflank, a cloud platform for running applications and databases, told customers to assume all environment variables on its platform had been compromised and rotate their secrets and credentials, as the cloud platform continued investigating a security incident first reported Friday, October 30.
In a Saturday update at 13:34 UTC, or 9:34 a.m. Eastern, the company said secret rotation for MySQL and Redis was now available to all customers. It again urged customers who had not done so to rotate all secrets.
The company’s warning applies to credentials stored in workloads, secret groups and global secrets. Northflank also advised customers to disable public access to database addons where it had been enabled.
Northflank said users had reported unauthorized use of AI API keys supplied to its platform. It advised customers to revoke existing credentials with their issuing providers, generate replacements, update affected workloads and review AI-provider usage and billing logs for unexpected activity.
The instruction to assume environment variables were compromised is the company’s precautionary guidance. Its incident notice does not establish that every customer’s credentials were stolen.
Northflank’s published timeline begins with a Wiz threat alert at 11:43 UTC Friday, followed by engineering review and network-policy patches. Rotation for Postgres and MongoDB was enabled Friday; audit logs were made available to all customers, including free users, early Saturday.
The incident remained open when checked Saturday afternoon. The notice did not disclose an affected-customer count, financial losses, an identified attacker or a confirmed root cause.
JBizNews Technology Desk
© JBizNews.com. All rights reserved. Unauthorized reproduction or redistribution is strictly prohibited.
