Bulutli ilovalarni joylashtirish platformasi Northflank mijozlarga platformada saqlangan barcha ma'lumotlar va sirlarni aylantirishni tavsiya qilmoqda, chunki xavfsizlik buzilishi mijozlarning AI API kalitlarining ruxsatsiz ishlatilishiga olib keldi.
Northflank — bu ishlab chiquvchilarga ilovalar, konteynerlar, ma'lumotlar bazalari va AI ilovalarni asosiy infratuzilmani boshqarmasdan joylashtirish va boshqarish imkonini beradigan bulutli platforma.
Kompaniya 30-oktabrda xavfsizlik hodisasini e'lon qildi va mijozlarga bulutli xavfsizlik kompaniyasi Wiz'dan tahdid haqida ogohlantirish olgandan so'ng darhol o'z muhit o'zgaruvchilari va API kalitlarini aylantirishni tavsiya qildi.
Tez orada Northflank barcha mijozlarga o'z muhit o'zgaruvchilari shifrlangan deb hisoblashlari va ularda saqlangan sirlar o'g'irlangan deb taxmin qilishlari kerakligini aytdi.
"Barcha muhit o'zgaruvchilari shifrlangan deb hisoblang. Barcha kalitlarni o'chiring/aylantiring," — deb ogohlantirdi Northflank 30-oktabrdagi yangilanishda.
Ilovalar odatda muhit o'zgaruvchilarida ma'lumotlar bazasi parollari, bulutli xizmat ma'lumotlari, autentifikatsiya tokenlari va API kalitlari kabi maxfiy ma'lumotlarni saqlaydi.
Agar ular ochilsa, bu ma'lumotlar boshqa mijoz xizmatlarini buzish uchun ishlatilishi mumkin, bu esa ma'lumotlar o'g'irlanishi yoki API kalitlari orqali ruxsatsiz to'lovlarga olib kelishi mumkin.
Northflank keyinchalik platformada saqlangan AI API kalitlarining ruxsatsiz ishlatilishi haqida bir nechta mijoz xabar berganini tasdiqladi.
"Foydalanuvchilar Northflank platformasiga taqdim etilgan AI API kalitlarining ruxsatsiz ishlatilishi haqida xabar berishdi," — dedi kompaniya.
"Agar siz hali Northflank'da saqlangan foydalanuvchi tomonidan taqdim etilgan sirlarni aylantirmagan bo'lsangiz, iltimos, buni darhol qiling."
Mijozlarga shuningdek, AI provayderlarining foydalanish va to'lov jurnallarini kutilmagan faoliyat uchun tekshirish va shubhali foydalanish haqida Northflank va o'z AI provayderlariga xabar berish tavsiya qilindi.
Northflank e'lon qilgan hodisa vaqt chizig'iga ko'ra, Wiz ularni 30-oktabrda 11:43 UTC da buzilish haqida ogohlantirgan, kompaniya muhandislari buni bir daqiqa keyin ko'rib chiqqan.
Northflank tezda tarmoq siyosati yamog'i bilan javob berdi, keyin 12:50 UTC va 13:05 UTC da qo'shimcha yamog'lar kiritdi. Kompaniya shuningdek, Wiz'ning hodisaga javob berish jamoasidan yordam so'radi.
Kompaniya hujumchilar tizimlariga qanday kirganini, qancha mijoz ta'sirlanganini yoki hujumchilar xabar berilgan AI API kalitlaridan tashqari boshqa ma'lumotlarni o'g'irlagan yoki suiiste'mol qilganini oshkor qilmagan.
Javob chorasi sifatida Northflank PostgreSQL, MongoDB, MySQL va Redis uchun ma'lumotlarni aylantirishni yoqdi.
Kompaniya shuningdek, bepul hisoblar ishlatadigan mijozlar ham kiritilgan holda, barcha mijozlar uchun audit jurnallarini yoqdi, bu ularga shubhali faoliyatni tekshirishga yordam beradi.
Northflank mijozlarga ish yuklari, sir guruhlari va global sirlarda saqlangan sirlarni aylantirishni va qo'shimchalar uchun ommaviy kirishni o'chirishni davom ettirishni tavsiya qiladi.
BleepingComputer Northflank bilan buzilish, uning mijozlarga ta'siri va saqlangan ma'lumotlarga kirilgan yoki o'g'irlanganligi haqida savollar bilan murojaat qildi, ammo javob olmagan.
Qora oktyabr
Buzilish AI ishlab chiqish platformalariga qaratilgan hujumlar seriyasi o'rtasida sodir bo'ldi, xavfsizlik tadqiqotchilari bu platformalarni qimmat AI xizmatlariga kirish uchun ishlatilishi mumkin bo'lgan API kalitlarini saqlagani uchun qimmatli nishon deb hisoblashadi.
"AI ishlab chiquvchilar platformalari uchun qora oktyabr" deb nomlangan hisobotda Wiz oktyabr oyida AI ishlab chiqish platformalariga ta'sir qilgan kamida to'qqizta xavfsizlik hodisasini aniqladi, jumladan Northflank, Railway, OpenCode, Warp va Lightning AI.
Railway hodisasi ham shifrlangan mijoz muhit o'zgaruvchilarining potentsial ochilishi bilan bog'liq edi, OpenCode esa ochilgan AI API kalitlarini oshkor qildi. Warp AI agent jurnallari va foydalanuvchi telemetriya ma'lumotlarini ochgan buzilishni xabar qildi.
Wiz aytishicha, bu hodisalarning ba'zilarida ishtirok etgan hujumchilar maxsus AI xizmat ma'lumotlarini o'z ichiga olgan muhit o'zgaruvchilarini nishonga olgan, bu esa LLMJacking deb nomlanuvchi amaliyot orqali suiiste'mol qilinishi mumkin.
LLMJacking o'g'irlangan ma'lumotlardan boshqa tashkilotning API kalitlari yordamida AI modellariga kirish, katta API to'lovlarini yaratish yoki o'g'irlangan kirishni qayta sotish imkonini berishdan iborat.
Wiz tekshirgan ikkita holatda buzilgan korporativ ma'lumotlar taxminan 2,5 million Amazon Bedrock API chaqiruvlarini amalga oshirish uchun ishlatilgan, bu esa taxminan 100 000 dollar AI foydalanishiga olib kelgan.
Tadqiqotchilar shuningdek, AI modellariga kirishni qayta sotadigan xizmatlar bilan bog'liq infratuzilmani ham aniqladilar, garchi ular bu operatsiyalarni dastlabki buzilishlar yoki keng ko'lamli suiiste'mol bilan bog'lay olmagan bo'lsalar ham.
Wiz to'qqizta hodisaning barchasi bir xil hujumchilar tomonidan amalga oshirilganini tasdiqlamagan. Biroq, ko'plab hodisalar AI API kalitlarini o'g'irlashga urinishlarni o'z ichiga olgan.
Northflank shuningdek, o'z hodisa yangilanishlarida Wiz tadqiqotiga murojaat qildi va mijozlar tomonidan xabar berilgan ruxsatsiz AI kalitlaridan foydalanish tadqiqotchilar ko'rgan hujumlar bilan bog'liq bo'lishi mumkinligini ta'kidladi.
Hujumchilar haqiqiy ma'lumotlarga ega bo'lgach, ularning harakatlarining faqat 37% to'xtatiladi
Umumiy oldini olish ballari dastlabki kirishdan keyin nima sodir bo'lishini yashirishi mumkin. Hujumchilar haqiqiy ma'lumotlardan foydalanganda, oldini olish keskin pasayadi.
Blue Report 2026 mijoz ishlab chiqarish muhitlarida o'tkazilgan 338 million simulyatsiya bo'yicha texnika bo'yicha himoyalarni o'lchaydi.
Hisobotni oling
Cloud application hosting platform Northflank is warning customers to rotate all credentials and secrets stored on its platform after a security breach led to unauthorized use of customers' AI API keys.
Northflank is a cloud platform that allows developers to deploy and manage applications, containers, databases, and AI applications without managing the underlying infrastructure.
The company disclosed a security incident on October 30, warning customers to immediately rotate their environment variables and API keys after receiving a threat alert from cloud security company Wiz.
Soon after, Northflank told all customers to assume their environment variables had been decrypted and that the secrets stored within them were stolen.
"Assume all environment variables have been decrypted. Disable/rotate all keys," Northflank warned in an October 30 update.
Applications commonly use environment variables to store sensitive information, including database passwords, cloud service credentials, authentication tokens, and API keys.
If exposed, these credentials can be used to breach other customer services, potentially leading to data theft or unauthorized charges through API keys.
Northflank later confirmed that multiple customers had reported unauthorized use of AI API keys stored on the platform.
"Users have reported unauthorised use of AI API keys supplied to the Northflank platform," the company said.
"If you have not already rotated your user-provided secrets stored in Northflank, please do so immediately."
Customers were also advised to review their AI provider usage and billing logs for unexpected activity and report suspicious usage to Northflank and their AI providers.
According to Northflank's published incident timeline, Wiz warned them about the breach at 11:43 UTC on October 30, which the company's engineers reviewed one minute later.
Northflank quickly responded with a network policy patch, followed by additional patches at 12:50 UTC and 13:05 UTC. The company also requested assistance from Wiz's incident response team.
The company has not disclosed how attackers gained access to its systems, how many customers were affected, or whether attackers stole or abused credentials other than the reported AI API keys.
As part of its response, Northflank enabled credential rotation for PostgreSQL, MongoDB, MySQL, and Redis.
The company also enabled audit logs for all customers, including those using free accounts, to help them investigate any suspicious activity.
Northflank continues to advise customers to rotate secrets stored in workloads, secret groups, and global secrets, and to disable public access to add-ons where enabled.
BleepingComputer contacted Northflank with questions about the breach, its impact on customers, and whether stored credentials were accessed or stolen, but has not received a response.
Black October
The breach comes amid a series of attacks targeting AI development platforms, which security researchers believe are valuable targets because they store API keys that can be used to access expensive AI services.
In a report titled "Black October for AI Developer Platforms," Wiz identified at least nine security incidents affecting AI development platforms during the month, including Northflank, Railway, OpenCode, Warp, and Lightning AI.
The Railway incident also involved potential exposure of decrypted customer environment variables, while OpenCode disclosed exposed AI API keys. Warp reported a breach that exposed AI agent logs and user telemetry data.
Wiz says attackers involved in some of these incidents have specifically targeted environment variables containing AI service credentials, which can be exploited through a practice known as LLMJacking.
LLMJacking involves using stolen credentials to access AI models using another organization's API keys, generating massive API charges or allowing the stolen access to be resold.
In two cases investigated by Wiz, compromised enterprise credentials were used to make approximately 2.5 million Amazon Bedrock API calls, generating approximately $100,000 in AI usage.
The researchers also discovered infrastructure linked to services reselling access to AI models, although they could not link those operations to the initial breaches or large-scale abuse.
Wiz has not confirmed that all nine incidents were conducted by the same attackers. However, many of the incidents involved attempts to steal AI API keys.
Northflank also referenced Wiz's research in its incident updates, noting that customer reports of unauthorized AI key usage may be tied to the attacks seen by the researchers.
Once attackers have valid credentials, only 37% of their actions are blocked
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Get the report