Cloudflare Breach: Hackers snatch source code, infiltrate internal knowledge

TLDR: Cloudflare has announced that it experienced a breach in which nation-state hackers accessed its source code and internal documents. The intrusion, detected in November 2023, involved stolen credentials and was carried out by a “sophisticated” actor with the aim of obtaining widespread access to Cloudflare’s global network. As a precautionary measure, Cloudflare rotated credentials, segmented systems, and conducted forensic triages. The attack involved a four-day reconnaissance period and resulted in the exfiltration of 76 source code repositories, primarily related to how backups work, network configuration, identity management, remote access, and the use of Terraform and Kubernetes. The attack was made possible by using stolen access tokens and service account credentials associated with AWS, Atlassian Bitbucket, Moveworks, and Smartsheet, which were obtained in a hack of Okta’s support case management system. Cloudflare failed to rotate these credentials and has since terminated all malicious connections. Cybersecurity firm CrowdStrike performed an independent assessment of the incident.