Cloudflare internal system breach exposes source code
Cloudflare's internal Atlassian systems were breached around Thanksgiving 2023. The attacker, believed to be state-sponsored, used credentials and authentication tokens stolen in the earlier Okta breach to access source code and internal documents, and the internal wiki and bug database were also affected. In its response, the company rotated about 5,000 production credentials.
Key facts
- Affected organisation
- Cloudflare
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Access to source code and internal documents; internal wiki and bug database affected
- Cause / method
- Access to internal Atlassian systems using credentials and authentication tokens stolen in the Okta breach
- Location
- United States
If your data was exposed
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- Cloudflare disclosed the internal system breach that occurred around Thanksgiving 2023 and the rotation of about 5,000 production credentials.
- It was reported that the attacker had accessed source code and internal documents.
9 related reports
- Nation-state actor used stolen Okta credentials in Thanksgiving attack, Cloudflare says
- Thanksgiving 2023 security incident
- Cloudflare hacked using auth tokens stolen in Okta attack
- Cloudflare hit by follow-on attack from previous Okta breach
- Cloudflare Breach: Nation-State Hackers Access Source Code and Internal Docs
- Hackers deploy login credentials they stole at Okta to hack Cloudflare – update
- The Secret's Out: How Stolen Okta Auth Tokens Led to Cloudflare Breach
- Cloudflare Hacked by Suspected State-Sponsored Threat Actor
- Cloudflare reveals Thanksgiving breach by 'sophisticated actor'
Other incidents at Cloudflare
Cloudflare AI responses expose other customers' request data in 155 cases
155Impact: Other customers' request data exposed in 155 AI responses
From 27 August to 9 September, 155 responses from the GLM-5.3 model on Cloudflare Workers AI included other customers' recent request data. The problem, caused by a combination of a context setting mismatch and a flaw in SGLang cache handling, has been fixed. No evidence of deliberate abuse was found.
Related reports: 2 · last report →Salesloft Drift breach affects Cloudflare and its customers
The Salesloft Drift breach affected Cloudflare and its customers. Cloudflare published a post explaining the impact on 2 September 2025.
Related reports: 3 · last report →DDoS attack briefly knocks Cloudflare's company website offline
Impact: Temporary outage of the company website
Cloudflare's company website suffered a temporary outage due to a DDoS attack. The company said the products and services it provides to customers were not affected. Anonymous Sudan claimed responsibility for the attack.
Read on BleepingComputer ↗
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.