Northflank customers reported unauthorized use of stored AI provider keys

After discovering a platform security incident, Northflank published an emergency warning that stored environment variables should be considered compromised. Its status timeline specifically reports unauthorized use of customer AI API keys and provides guidance to revoke credentials with their issuing providers. MySQL, Redis, Minio and RabbitMQ rotation capabilities were added in later status updates. The public notice does not identify every affected customer or prove a single intrusion path for the downstream key use.

An AI provider key may remain active after the workload that held it is stopped, so deleting a container or rotating a platform password is not equivalent to revocation at the issuing model provider. Incident response needs provider-side revocation, request and billing review, and independent checking of every copied deployment secret. The public disclosure does not establish that all reported unauthorized inference is one attacker campaign.