Northflank security breach leads to abuse of customers' AI API keys

Attackers who breached Northflank's cloud platform were able to access customers' AI API keys and encrypted environment variables, demonstrating how a single platform compromise can cascade into widespread credential exposure across an entire customer base. Storing sensitive secrets — even in encrypted form — within a shared platform creates a high-value target, and insufficient isolation between platform-level access and customer secrets amplified the blast radius. The incident also highlights that AI API keys are increasingly lucrative targets, as they can be monetized immediately through compute-intensive abuse. The fact that Northflank had to advise customers to manually rotate credentials and audit billing suggests reactive rather than proactive secret management controls were in place.