Cloud deployment platform Northflank has told every customer to treat their stored secrets as stolen following a breach, with users reporting abuse of AI API keys held on the service. Wiz says the breach is the ninth in a month-long wave of attacks on AI developer platforms, which it calls “Black October” and links to a growing resale market for stolen model access.
What happened
On 30 October 2026 Northflank, which hosts containers, databases and AI workloads for developers, posted a security incident on its status page. The first instruction was to rotate environment variables immediately. Eighteen minutes later customers were told to assume every environment variable had been decrypted and to disable or rotate all keys.
The company’s own timeline says the trigger was a threat alert from Wiz at 11:43 UTC. Engineers looked at it a minute later, pushed a network policy change at 12:02 and further patches at 12:50 and 13:05, and called in Wiz’s incident response team at 13:00. By mid-afternoon several customers had confirmed that their AI keys had been used by someone else. A late-evening update acknowledged reports of “unauthorised use of AI API keys” and pointed users to Wiz’s research for matching IP addresses.
Through 31 October Northflank added secret rotation for its managed database and queue add-ons and enabled audit logs for every account, free tier included. By its last update, at 23:31 UTC on Saturday, it had not explained the initial access, the number of customers affected or whether anything beyond AI credentials was taken. BleepingComputer said its questions had gone unanswered.
Late on 30 October, Wiz researchers Benjamin Read and Rami McCarthy published an analysis linking Northflank to at least eight other October incidents: Fireworks AI, Andromeda, Zeabur, Lightning AI, OpenCode, Railway, Warp and CommandCode. According to Wiz, Zeabur will close down as a result of its breach.
The technical picture
There is no single vulnerability tying the nine incidents together. The root causes disclosed so far vary: credential compromise at Fireworks, Zeabur and Lightning AI, a privilege escalation in build infrastructure at Railway, a suspected third-party vendor dependency at Warp and a “legacy system” at OpenCode. Fireworks, OpenCode and Warp have reported signs of an automated “agent swarm”, while OpenCode and CommandCode blame attempts at model distillation. The common thread is the objective. According to Wiz, in every public account the intruders went looking for stored environment variables, especially those holding keys for AI services.
Wiz’s report follows two enterprise keys stolen through one of these vendor breaches. Each was tested within 30 minutes with a single model call from a residential address, then quietly re-checked by a low-volume job for days.
In the first case, after probing available models and enumerating Amazon Bedrock and EC2 quotas, the attacker ran roughly 800,000 Bedrock calls over 30 hours, about 90% successfully. The key permitted global inference routing, so load spread across regions and only around 6% of calls hit throttling. The second key was limited to US routing. That slowed the attacker but did not stop them: one hosting address pushed roughly 1.7 million requests over 13 hours, over a million of which worked. Wiz estimates the combined list-price cost was likely more than $100,000, with traffic resembling resold coding-assistant usage.
Wiz also linked the keys to two open resale operations: an actor apparently called “momo”, tied to llm-routing.com and to an IP address Zeabur named in its own report, and a second hub, Xingjiabi, which tested both keys once the abuse was under way. Wiz cannot prove either carried out the intrusions, but several actors handling the same credentials suggests an established market.
Why it matters for UK organisations
Platforms like Northflank, Railway and Fireworks AI are popular with UK start-ups, agencies and internal innovation teams working outside the main corporate cloud estate. They are often bought on a company card and missing from the supplier risk register. The secrets they hold are frequently long-lived keys for AWS, AI providers, payment services and production databases.
The financial exposure is immediate. A stolen Bedrock or OpenAI key does not trigger a data breach notification on its own, but it can generate a five or six-figure bill in a weekend, and recovering those costs depends on the goodwill of the provider. Where the same environment variables held database credentials, the question changes. If personal data could have been accessed, organisations will need to assess whether the incident is reportable to the ICO within 72 hours under UK GDPR, and they cannot do that properly without logs.
The wider supply chain lesson is that Northflank’s advice puts every customer into incident response, whether or not they were individually targeted. That is the price of handing secrets to a third party.
Expert view
In my experience, environment variables are where good intentions about secrets management go to die. When we test cloud-native estates, we routinely find production keys in plaintext deployment settings, shared between staging and live, never expiring and over-privileged. Black October shows attackers now hunt for them at scale.
What strikes me in the Wiz data is how much the key’s own policy mattered. The unrestricted key was drained almost without friction; the one limited to specific regions slowed the attacker and caused most of the excess calls to fail on quota. That is not a cure, but it is evidence that least privilege and spending limits on AI credentials buy real time. The other notable detail is the patience: days of quiet validation calls before the burst. That window is where usage monitoring and billing alerts earn their keep.
I would also resist calling this purely an AI problem. The entry routes are ordinary: stolen credentials, build pipeline flaws, a weak dependency. AI keys are simply the most liquid loot right now.
What to do now
- Find your exposure. Ask development teams whether Northflank or the other eight named platforms are in use, including trial accounts.
- Rotate, do not just review. If you use any affected platform, revoke and reissue every secret stored there at the issuing provider, then update workloads. Prioritise cloud provider keys, AI API keys, database credentials and payment keys.
- Check usage and billing logs. Review AI provider dashboards and AWS CloudTrail for Bedrock InvokeModel calls, quota enumeration and activity from unfamiliar addresses since early October. Compare against the IP indicators Wiz has published.
- Restrict AI keys. Scope keys to the models and regions you actually use, set hard spending caps and alerts, and avoid broad cross-region inference permissions unless you need them. This maps to Cyber Essentials secure configuration and user access control.
- Move secrets into a vault. Prefer short-lived, workload-bound credentials to static keys in environment variables.
- Bring developer platforms into supplier assurance. Record them, understand where secrets live and confirm audit logging is switched on, so you can investigate the next incident rather than guess.
Bottom line
Northflank’s breach is part of a pattern. Stolen AI keys now have ready buyers, and platforms holding them in bulk are prime targets. Any UK organisation whose teams deploy through these services should assume their secrets are in play, rotate them now and put limits on what a stolen key can do.
