Cloudflare Atlassian Breach Traced to Unrotated Credentials Stolen from Okta

A suspected nation-state actor breached Cloudflare’s self-hosted Atlassian environment in November 2023 using one access token and three service-account credentials stolen during the October Okta breach that Cloudflare had failed to rotate. The attacker accessed Confluence, Jira, and Bitbucket, established persistence through ScriptRunner for Jira, and downloaded 76 source-code repositories, which Cloudflare treated as exfiltrated. The activity appeared aimed at understanding Cloudflare’s global network architecture and security; an attempt to access a console server associated with a not-yet-operational São Paulo data center failed.

Cloudflare detected the intrusion on November 23 and terminated the attacker’s access by November 24, later disclosing the incident on February 1, 2024. The company said customer data, customer systems, and its global network were unaffected, crediting zero-trust controls with limiting lateral movement. Its “Code Red” response included an independent CrowdStrike investigation, rotation of more than 5,000 production credentials, forensic triage of 4,893 systems, and additional segmentation and system reboots. The breach underscores the need to comprehensively revoke exposed service credentials and tokens after an identity-provider compromise, rather than relying solely on user-account remediation.