# Security incident

- Provider: [Northflank](https://down.guide/northflank)
- Level: confirmed
- Impact: Major outage
- monitoring a fix, open 7d 5h
- started 2026-10-30 13:40 UTC
- id: DWN-2b6b739d6e
- Official page: https://status.northflank.com/cmvv0rn5a092f14rutwccodpp

## Summary
Northflank says its security incident is in monitoring. It believes the attack vector was contained within an hour of the first alert, and its platform and customer workloads have stayed online with no evidence that workloads or workload data were accessed.

_Written by anthropic/claude-haiku-5.5 from Northflank's own updates._

## Updates from Northflank
### 2026-11-02 11:09 UTC: monitoring
We believe the attack vector was contained within an hour of the first alert. Our investigation shows no sign that the attacker was in our environment after the attack. Independent forensic auditors began reviewing the attack together with Northflank over the weekend, and they c…

### 2026-11-06 10:09 UTC: monitoring
The platform has remained operational and customer workloads have remained online throughout the incident. At this time, we have found no evidence that customer workloads or workload data were accessed. The first known decryption of secrets occurred between 02:39 UTC and 03:08 U…

---
down.guide reads providers' official status pages every minute and adds its own evidence, always labeled. Free, no account. Agents: MCP at https://down.guide/mcp, REST at https://down.guide/api/v1, feeds at https://down.guide/feed. Built by Sazabi (https://sazabi.com/?utm_source=down-guide&utm_medium=markdown).