Zero Radar
← feed
HighData breachupdated 31 Oct 2026, 18:03 UTC

Northflank breach exposed customers' AI API keys to misuse

Attackers got into the Northflank hosting platform and used customers' AI service keys without permission. Those keys can be used to run up bills or access AI services as if they were the customer.

Attacks reported (BleepingComputer)1 source, unconfirmed
SeverityHighData breach
Being exploited?ReportedBy BleepingComputer, not officially confirmed yet
What to doCheck exposureRotate all AI API keys and other secrets stored on Northflank now.
How sure is this?1 source, unconfirmedOnly one publisher so far, details may change

How the attack works simplified

  1. 1Attacker breaches NorthflankEntry method not stated in material
  2. 2Platform secrets exposedCustomer credentials stored on platform
  3. 3AI API keys obtainedKeys taken from platform data
  4. 4Keys used by attackerUnauthorized calls to AI services
  5. ResultAttacker uses customers' AI API keys

What happened

A security breach at cloud hosting platform Northflank led to unauthorized use of customers' stored AI API keys; the material does not specify the entry point or technical flaw.

Why it is dangerous: Anyone whose AI API keys or other secrets were stored on Northflank may face unauthorized charges and misuse of their AI accounts.

Are you affected?

You are affected if you stored AI API keys or other credentials or secrets on the Northflank platform.

Northflank customers who stored AI API keys or other credentials/secrets on the platform (versions unknown).

What to do

  1. Rotate all credentials and secrets stored on Northflank, including AI API keys
  2. Check your AI provider accounts for unexpected usage or charges
  3. Review Northflank's official security notice for further details

Timeline

  1. 31 Oct 2026, 18:01 UTC
    Publicly disclosed
  2. 31 Oct 2026, 18:01 UTC
    Reported by BleepingComputer · BleepingComputer
  3. 31 Oct 2026, 18:03 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Security press established security newsrooms

Technical details

ID
ZR-ba55b05e
Disclosed
31 Oct 2026, 18:01 UTC
On Zero Radar
31 Oct 2026, 18:03 UTC (2 min after disclosure)
Last change
31 Oct 2026, 18:03 UTC

The plain-language parts and the attack diagram were written by an AI model (claude-haiku-5-5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Northflank breach exposed customers' AI API keys to misuse · Zero Radar