Cloudflare’s 2023 incident: the credentials that were not rotated.
How leftover credentials enabled access, how the intrusion was detected and why segmentation limited the impact.
What happened?
Historical case. Detected: 23 November 2023. Disclosure: 1 February 2024. Source checked: 22 October 2026.
Cloudflare disclosed unauthorized access to its self-hosted Atlassian environment. It said an access token and three service-account credentials, taken during the earlier Okta compromise, had not been rotated.
What caused the weakness?
Changing some credentials is not the same as completing the rotation inventory. The remaining credentials allowed access to internal systems and some documentation and source code.
How was it identified?
Cloudflare detected the actor on 23 November, investigated and cut off access. It brought in CrowdStrike for independent forensic analysis.
How far did it spread?
Cloudflare reported that customer data and systems were not affected. Access controls and network boundaries limited lateral movement. The distinction matters: a serious internal incident does not automatically mean every customer was compromised.
What was the response?
The company described credential rotation, forensic review and longer-term hardening work.
Primary source: Cloudflare’s incident report.
Try the concept safely
Create two dummy service tokens for a tiny local application. Revoke one and show that the forgotten token still works. Then revoke both and verify rejection.
Use a checklist linking each credential to its service and owner. This illustrates incomplete revocation; it does not require stealing tokens or running an intrusion tool.