Cloudflare security incident history
Hacking, data breaches and other security incidents involving Cloudflare, with related coverage.
Cloudflare AI responses expose other customers' request data in 155 cases
155Impact: Other customers' request data exposed in 155 AI responses
From 27 August to 9 September, 155 responses from the GLM-5.3 model on Cloudflare Workers AI included other customers' recent request data. The problem, caused by a combination of a context setting mismatch and a flaw in SGLang cache handling, has been fixed. No evidence of deliberate abuse was found.
Related reports: 2 · last report →Salesloft Drift breach affects Cloudflare and its customers
The Salesloft Drift breach affected Cloudflare and its customers. Cloudflare published a post explaining the impact on 2 September 2025.
Related reports: 3 · last report →Cloudflare internal system breach exposes source code
Impact: Access to source code and internal documents; internal wiki and bug database affected
Cloudflare's internal Atlassian systems were breached around Thanksgiving 2023. The attacker, believed to be state-sponsored, used credentials and authentication tokens stolen in the earlier Okta breach to access source code and internal documents, and the internal wiki and bug database were also affected. In its response, the company rotated about 5,000 production credentials.
Related reports: 9 · last report →DDoS attack briefly knocks Cloudflare's company website offline
Impact: Temporary outage of the company website
Cloudflare's company website suffered a temporary outage due to a DDoS attack. The company said the products and services it provides to customers were not affected. Anonymous Sudan claimed responsibility for the attack.
Read on BleepingComputer ↗