Northflank environment variable compromise and AI API key abuse

Northflank, a cloud application hosting provider, experienced a security breach in which unauthorized actors accessed customer account data. The attackers specifically targeted and exfiltrated environment variables, which included API keys for various AI services. These keys were subsequently used by threat actors to perform unauthorized computing tasks using customers' cloud-based AI resources, a technique referred to by researchers as 'LLMjacking'.

Impact

The breach resulted in the compromise of sensitive customer environment variables and the theft of AI API keys. This enables unauthorized third parties to charge computing costs to the victims' accounts and potential access to underlying AI service platforms.

Recommendation

• Rotate all API keys and secrets stored within Northflank environment variables immediately.
• Review AI provider billing logs and usage dashboards for spikes in activity or anomalous requests originating from IP addresses or locations not associated with your infrastructure.
• Implement tight access controls on API keys, utilizing scoping and restrictive usage limits where supported by the AI service provider.
• Audit current environment variable configurations to ensure no unnecessary sensitive credentials are stored in plain text or accessible via platform management interfaces.