Northflank Breached

Users have reported unauthorised use of AI API keys supplied to the Northflank platform.

用户报告称，提供给 Northflank 平台的 AI API 密钥遭到了未经授权的使用。

If you have not already rotated your user-provided secrets stored in Northflank, please do so immediately. Revoke existing credentials with their issuing providers, generate replacements, and update the affected secrets and workloads in Northflank. Review your AI provider usage and billing logs for unexpected activity, and report any suspicious usage to Northflank support and the relevant provider.

如果您尚未轮换存储在 Northflank 中的用户自备密钥，请立即执行此操作。请撤销颁发机构提供的现有凭据，生成新的凭据，并更新 Northflank 中受影响的密钥和工作负载。请检查您的 AI 提供商使用情况和账单日志以发现异常活动，并将任何可疑使用情况报告给 Northflank 支持团队及相关提供商。

These reports may be consistent with the broader pattern of attacks targeting AI credentials. Similar IP addresses are contained in this article Wiz’s “Black October” report.

这些报告可能与针对 AI 凭据的更广泛攻击模式相符。Wiz 的“黑色十月”报告中包含了类似的 IP 地址。

Our investigation is ongoing. We have no further confirmed findings to share at this time. Our guidance remains unchanged: assume all environment variables have been compromised and rotate all secrets and credentials immediately, including those in workloads, secret groups and global secrets. Disable public access to addons where enabled. We will share further updates as more information is confirmed.

我们的调查仍在进行中。目前我们没有更多已确认的发现可以分享。我们的指导建议保持不变：假设所有环境变量均已泄露，并立即轮换所有密钥和凭据，包括工作负载、密钥组和全局密钥中的凭据。禁用已启用的插件公共访问权限。随着更多信息的确认，我们将分享进一步的更新。

Secret rotation on Postgres and MongoDB has been enabled for all users. We recommend disabling public expose on addons if you have enabled that.

所有用户的 Postgres 和 MongoDB 密钥轮换功能已启用。如果您启用了插件的公共暴露功能，我们建议将其禁用。

All users should assume their environment variables are decrypted and begin rotation immediately. Secrets on workloads

所有用户都应假设其环境变量已被解密，并立即开始轮换。工作负载上的密钥。

Multiple users are confirming that their AI keys have been used.

多名用户确认其 AI 密钥已被使用。

Assume all environment variables have been decrypted. Disable/rotate all keys.

假设所有环境变量已被解密。禁用/轮换所有密钥。

Rotate environment variables immediately.

立即轮换环境变量。

11:43 UTC: Wiz threat alert

11:43 UTC：Wiz 威胁警报

11:44 UTC: Northflank engineers review the alert

11:44 UTC：Northflank 工程师审查该警报

12:02 UTC: Initial network policy patch 12:50 UTC: Additional patching deployed

12:02 UTC：初始网络策略补丁；12:50 UTC：部署额外补丁

13:00 UTC: Wiz CIRT support requested

13:00 UTC：请求 Wiz CIRT 支持

13:05 UTC: Additional patching deployed

13:05 UTC：部署额外补丁

13:05 UTC: Additional patching deployed

13:05 UTC：部署额外补丁

Networking - Major outage

网络 - 重大故障

Certificates - Major outage

证书 - 重大故障

Services - Major outage

服务 - 重大故障

Addons - Major outage

插件 - 重大故障

Builds - Major outage

构建 - 重大故障

Logs and Metrics - Major outage

日志和指标 - 重大故障

Northflank App - Operational

Northflank 应用 - 正常运行

Northflank API - Operational

Northflank API - 正常运行

Marketing Site - Operational

营销网站 - 正常运行

Documentation - Operational

文档 - 正常运行