# Cloudflare’s Thanksgiving incident: a rotation checklist needs closure evidence

Canonical: https://www.web3sec.news/blog/cloudflare-token-rotation
Author: Raiders (https://www.web3sec.news/about)
Format: postmortem
Topic: Web2
Published: 2026-11-08
Updated: 2026-11-08
Incident date: 2023-11-23

A 2024 disclosure about a 2023 intrusion shows how residual credentials can outlive an initial response.

## Separate the incident date from the disclosure

Cloudflare disclosed this event on 1 February 2024, describing an intrusion detected on 23 November 2023. Its report says an attacker used one access token and three service-account credentials that had not been rotated after the October 2023 Okta compromise.

Cloudflare reported access to its Atlassian environment and a limited amount of source code, while stating customer data and systems were not impacted. Its account credits segmentation and access controls with restricting lateral movement. This is a historical case study, not a new incident alert.

## Replace “rotated” with a verifiable state transition

Our analysis: credential rotation is complete when the previous credential no longer works, its consumers have moved and the evidence is recorded. A ticket marked done does not establish any of those conditions.

For each potentially exposed identity, record an owner, reachable systems, token types, expiration behavior and dependent workloads. Include service accounts, integration tokens, browser sessions and recovery methods. Verify revocation using a controlled check that does not expose secret values in logs.

## Limit what one missed identity can reach

Classify internal documentation and source-code systems by the operational access they reveal. Design access from those systems to production so that possession of one internal identity is insufficient. Short-lived credentials and distinct administrative identities can narrow the window and reach of a missed rotation.

Exercise a partial failure: intentionally leave a test identity outside the initial rotation list, then assess whether inventory reconciliation finds it. The goal is to verify the response mechanism, not merely the team’s ability to follow a known list.

## Controls to take away

- Prove old credentials and sessions have been invalidated.
- Track service identities and integration tokens explicitly.
- Use segmentation to limit the consequences of a missed rotation.

## Sources & further reading

- [Cloudflare: Thanksgiving 2023 security incident, disclosed 1 February 2024](https://blog.cloudflare.com/thanksgiving-2023-security-incident/)

Incident facts are attributed to the linked reports. Recommendations are Web3Sec's analysis.

[Research methodology](https://www.web3sec.news/methodology) · [Editorial policy](https://www.web3sec.news/editorial-policy) · [Send a correction](https://www.web3sec.news/contact)