Separate the incident date from the disclosure
Cloudflare disclosed this event on 1 February 2024, describing an intrusion detected on 23 November 2023. Its report says an attacker used one access token and three service-account credentials that had not been rotated after the October 2023 Okta compromise.
Cloudflare reported access to its Atlassian environment and a limited amount of source code, while stating customer data and systems were not impacted. Its account credits segmentation and access controls with restricting lateral movement. This is a historical case study, not a new incident alert.
Replace “rotated” with a verifiable state transition
Our analysis: credential rotation is complete when the previous credential no longer works, its consumers have moved and the evidence is recorded. A ticket marked done does not establish any of those conditions.
For each potentially exposed identity, record an owner, reachable systems, token types, expiration behavior and dependent workloads. Include service accounts, integration tokens, browser sessions and recovery methods. Verify revocation using a controlled check that does not expose secret values in logs.
Limit what one missed identity can reach
Classify internal documentation and source-code systems by the operational access they reveal. Design access from those systems to production so that possession of one internal identity is insufficient. Short-lived credentials and distinct administrative identities can narrow the window and reach of a missed rotation.
Exercise a partial failure: intentionally leave a test identity outside the initial rotation list, then assess whether inventory reconciliation finds it. The goal is to verify the response mechanism, not merely the team’s ability to follow a known list.
Controls to take away
- Prove old credentials and sessions have been invalidated.
- Track service identities and integration tokens explicitly.
- Use segmentation to limit the consequences of a missed rotation.
Sources & further reading
Incident facts are attributed to the reports below. Controls and recommendations are our interpretation; this is not an independent forensic investigation.
A correction or a better primary source? Send Raiders the article URL and evidence. Editorial policy.