THANKSGIVING 2023 SECURITY INCIDENT

Summary from the TLDR Web Dev newsletter

In November 2023, Cloudflare detected a security incident where a threat actor gained access to its self-hosted Atlassian server. Despite this, Cloudflare assured its customers that no customer data or systems were affected. The incident was traced back to stolen credentials from an Okta compromise in October, with the threat actor conducting reconnaissance and accessing internal systems, mainly Atlassian products. Cloudflare responded with a "Code Red" effort to strengthen security, rotating over 5,000 production credentials, segmenting systems, and performing forensic triages. The threat actor was ultimately denied access. Cloudflare notes that it believes the attack was performed by a nation-state.