AI API keys stolen at Northflank

The Northflank security breach came to light after the company urged its customers to change all their private keys. The cloud hosting platform announced the incident on October 30, following a threat alert from Wiz. Moreover, multiple customers reported unauthorized use of their AI API keys.

The API key works like a digital password that allows an application to talk to services like OpenAI. The person who obtains this key can use the service at a cost to you. Therefore, leakage carries the risk of direct material damage.

How Did the Northflank Security Breach Evolve?

According to the timeline shared by the company, Wiz warned Northflank at 11:43 UTC on October 30. Engineers began investigating the alert a minute later. Patches were then deployed at 12:50 and 13:05. One of them was a network policy patch.

Northflank also requested support from the Wiz team for incident response. However, the company's warning to customers is quite harsh. Northflank wants all environment variables to be considered resolved. Environment variables are areas where applications store settings such as passwords and keys.

Accordingly, users need to deactivate or renew all keys. The company urged those who have not yet changed their confidential information to do so immediately. It is also recommended to check the usage and billing records of artificial intelligence providers.

What Precautions Did the Company Take?

Northflank has turned on credential renewal for PostgreSQL, MongoDB, MySQL, and Redis. Additionally, it enabled audit trails for all customers, including free accounts. Thus, users can track the movements in their accounts after the Northflank security breach.

The company also recommends turning off open access to add-ons. Yet some questions remain unanswered. It is not yet clear how the attackers got into the system and how many customers were affected.

It is also unclear whether information other than AI keys were accessed. For this reason, the Northflank security breach also concerns companies that maintain databases on the platform. The company has not yet made an additional statement on this matter.

Nine Separate Incidents Happened in October

Wiz's report titled "Black October" shows that the incident was not isolated. According to the report, there were at least nine incidents targeting artificial intelligence development platforms in October. In addition to Northflank, Railway, OpenCode, Warp and Lightning AI are also on this list.

According to Wiz, some attackers specifically targeted AI service keys. This method is called LLMJacking, that is, language model access usurpation. For example, approximately 2.5 million Amazon Bedrock API calls were made with corporate information compromised in two cases. This led to approximately $100,000 in AI use.

However, Wiz did not confirm that the same attackers were behind the nine incidents. Northflank users must renew their keys immediately and report suspicious use to both the company and the artificial intelligence provider.