Black October hits PaaS: Northflank, secret storage and AI key resale

On October 30, 2026, PaaS platform Northflank disclosed a security incident and asked customers to assume that all environment variables on the platform had been decrypted and to rotate all keys; within hours, customers reported unauthorized use of AI API keys stored on the platform. This was the ninth AI development platform to disclose a security incident that month, and Wiz Research called this series of incidents Black October. Two case studies by Wiz showed that stolen enterprise Amazon Bedrock credentials were abused at scale within days of validation, generating approximately 800,000 and 1.7 million model calls respectively, which Wiz estimated cost more than $100,000 at list prices; infrastructure associated with two operators publicly reselling discounted access to frontier models had contact with the stolen keys, but Wiz could not conclusively link it directly to the intrusion. The note also reviews the details of the Railway and Zeabur incidents, and recommends rotating and revoking all stored keys, setting mandatory spending limits for AI keys, and designing architectures on the assumption that long-term AI credentials held by third-party platforms may leak.