Cloudflare Atlassian intrusion with credentials left unrotated after the Okta breach
From November 14 to November 24, 2023 an attacker Cloudflare believes was a nation state used one access token and three service account credentials taken in the October 2023 Okta support breach, which Cloudflare had failed to rotate, to reach its Atlassian Confluence, Jira and Bitbucket. The attacker viewed internal wiki pages and bug tickets and accessed some source code. Cloudflare disclosed on February 1, 2024 and rotated more than 5,000 production credentials in a Code Red remediation.
- Victim
- Cloudflare
- Industry
- Technology
- Country
- United States
- Intrusion began
- Nov 14, 2023
- First disclosed
- Feb 1, 2024
- Actor
- Nation-state
- Initial access
- Stolen credentials
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
After a third-party breach, every credential that party could have seen must be rotated, including service accounts thought to be unused. Rotation that misses a few is rotation that failed.
Go deeper on SWI
- Teardown: Okta's 2023 support-system breach: when your IdP gets phished
- Technique: Static API key abuse
Sources
- Thanksgiving 2023 security incident, Cloudflare, Feb 1, 2024
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- GitHub repositories cloned with a compromised machine-account token 2023 · Stolen credentials
- LastPass customer vault backup theft via engineer credentials and trusted device cookie 2022 · Stolen credentials
- GhostAction returns: hijacked GitHub accounts push secret-stealing workflows 2026 · Stolen credentials
- TeamViewer corporate IT intrusion via a compromised employee account 2024 · Stolen credentials
Cite this record
SWI Community Team. (2026). Cloudflare Atlassian intrusion with credentials left unrotated after the Okta breach. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2024-cloudflare-unrotated-okta-breach-credentials/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.