Cloud deployment platform Northflank opened a security incident on its status page on 30 October 2026, marked as a major outage affecting the Northflank Platform.

At 13:40 UTC (9:40 pm Perth) Northflank told users to rotate environment variables immediately; at 13:58 UTC (9:58 pm Perth) it said to assume all environment variables had been decrypted and to disable or rotate all keys.

In an update at 15:12 UTC (11:12 pm Perth) Northflank said all users should assume their environment variables are decrypted and begin rotation immediately, listing secrets on workloads, secret groups and global secrets, and said multiple users are confirming that their AI keys have been used. The incident timeline on the page starts with a Wiz threat alert at 11:43 UTC (7:43 pm Perth), reviewed by Northflank engineers a minute later, followed by an initial network policy patch at 12:02 UTC (8:02 pm Perth), further patches at 12:50 and 13:05 UTC, and a request for support from the Wiz CIRT at 13:00 UTC.

Northflank has not said on the page how the variables were exposed or how many customers are affected. (source: Northflank status page)