Northflank's Timeline Has Secrets Decrypted at 02:39 UTC and the First Alert at 11:43

Northflank's own incident timeline puts the first known decryption of customer secrets between 02:39 and 03:08 UTC on Oct. 30, and the first security alert, from Wiz, at 11:43 UTC the same day: a gap of at least 8 hours 35 minutes in which the platform had no warning. Customers who stored environment variables there are told to assume every one was decrypted.

The detail comes from the Nov. 6 update to Northflank's status incident, one of 11 updates between Oct. 30 and Nov. 6. The status feed has no entries for Nov. 7 to 12, and the promised root cause analysis has not appeared in it.

The timeline Northflank has published

Time (UTC)	Event
Oct 30, 02:39 to 03:08	First known decryption of secrets
Oct 30, 11:43	Wiz threat alert reaches Northflank
Oct 30, 13:40	Customers told to rotate environment variables
Oct 30, 13:58	Told to assume all variables were decrypted
Oct 30, 23:38	Users report unauthorised use of AI API keys
Nov 2, 11:09	Update says the vector was contained within an hour of the first alert
Nov 6, 10:09	First-decryption window published

Northflank says it patched the exploit within 60 minutes of notification and told customers within two hours. Both claims are measured from the alert, not from the intrusion. Measured from the start of the decryption window, exposure ran about nine hours before anyone at Northflank knew. BleepingComputer's report says Northflank engineers reviewed the Wiz alert one minute after it arrived and deployed a network policy patch the same day, with more at 12:50 and 13:05.

What the vector was, and was not

The Nov. 2 update says a CVE was patched across the fleet, including bring-your-own-cloud clusters, but the status text this article read does not give the identifier. Northflank has not published how the attacker got in or how many customers were affected. BleepingComputer states no CVE, no attack vector and no customer count appear in its reporting either.

What Northflank does say: the attack appeared focused on secrets in the control plane, running workloads were unaffected, and dedicated and forward-deployed control planes were not. It also says there is no evidence that customer workloads or data were accessed, which is a statement about workloads and leaves the decrypted secrets themselves as the exposure.

Customer exposure, in Northflank's own words

The Oct. 30 update told customers: "Assume all environment variables have been decrypted." Users later reported AI keys being used; Northflank advised revoking credentials at the issuing providers and checking billing logs. It enabled secret rotation for PostgreSQL, MongoDB, MySQL, Redis, Minio and RabbitMQ add-ons between Oct. 30 and Oct. 31, and turned on audit logs for all customers including free accounts on Oct. 31 at 01:04 UTC.

Northflank revoked some access tokens, sessions, VCS integrations and cross-account IAM roles, so customers must sign in again and reconnect integrations. An independent forensic firm is reviewing the case.

Where it sits in the wider pattern

Wiz's Black October roundup lists Northflank as the ninth of nine October incidents and says it found no single vulnerability linking them. The credential-first pattern matches the Chainstack intrusion and the GitBook post-mortem, where the path to production secrets mattered more than the first foothold.

The next fixed point is Northflank's root cause analysis, which its Nov. 6 update says will follow once forensic findings are confirmed. Until it appears, rotate every secret stored there, starting with AI provider, cloud and payment credentials.