Security News > 2024 > February > Cloudflare hacked using auth tokens stolen in Okta attack

Cloudflare disclosed today that its internal Atlassian server was breached by a 'nation state' attacker who accessed its Confluence wiki, Jira bug database, and Atlassian Bitbucket source code management system.
"They then returned on November 22 and established persistent access to our Atlassian server using ScriptRunner for Jira, gained access to our source code management system, and tried, unsuccessfully, to access a console server that had access to the data center that Cloudflare had not yet put into production in São Paulo, Brazil," Cloudflare said.
To access its systems, the attackers used one access token and three service account credentials stolen during a previous compromise linked to Okta's breach from October 2023 that Cloudflare failed to rotate.
"Even though we understand the operational impact of the incident to be extremely limited, we took this incident very seriously because a threat actor had used stolen credentials to get access to our Atlassian server and accessed some documentation and a limited amount of source code," Cloudflare said.
On October 18, 2023, Cloudflare's Okta instance was breached using an authentication token stolen from Okta's support system.
Following the incident, the company said that its Security Incident Response Team's quick response contained and minimized the impact on Cloudflare systems and data and that no Cloudflare customer information or systems were impacted.
News URL
Related news
- Pump.fun X account hacked to promote scam governance token (source)
- Case Study: Are CSRF Tokens Sufficient in Preventing CSRF Attacks? (source)
- Recent GitHub supply chain attack traced to leaked SpotBugs token (source)
- SpotBugs Access Token Theft Identified as Root Cause of GitHub Supply Chain Attack (source)
- That massive GitHub supply chain attack? It all started with a stolen SpotBugs token (source)