Northflank’s October 30 breach exposed unencrypted environment variables with API keys. Wiz documented nine platforms breached in October with identical attack surfaces, credentials flowing into organized resale markets. Attackers call it “LLMJacking”: stealing API keys and hammering expensive services until accounts drain or detection triggers.
The industrialization is evident in the numbers. One Northflank customer saw 1.7 million Bedrock calls in 13 hours; another case incurred $50,000 in charges. The attackers didn’t stumble into these targets. They’re systematically exploiting unencrypted secrets across multiple platforms, indicating either coordination or a newly-weaponized vulnerability class.
For AI platforms, the blast radius of a compromised key is uniquely large. A single stolen credential can generate thousands in charges within hours, before monitoring catches up. That makes them prime targets for attackers operating an industrial resale pipeline.
Sources: Black October for AI Developer Platforms • Northflank Security Incident Status
Coverage: Northflank security breach leads to abuse of customers’ AI API keys
Related on this blog: [AUTO] Any User Can Become Admin in LiteLLM • [AUTO] MemTensor Worm Exploits GitHub Actions Token Interception • [AUTO] PingCAP breach: internal assets exposed, customer data reportedly untouched