# Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach · pwn.watch

> A suspected nation-state attacker used one access token and three service account credentials stolen in the October Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's Atlassian Confluence, Jira and Bitbucket. Cloudflare said customer data and systems were not affected.

Page: https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion · generated 2026-10-22T22:54:30.229Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Cloudflare internal Atlassian environment
- Started: 2023-11-14 · closed: 2024-02-01

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion/feed.xml
- JSON Feed: https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion.json
- This file: https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion/llms.txt

## Updates (newest first)
- 2024-02-01: Cloudflare publishes its full write-up (https://blog.cloudflare.com/thanksgiving-2023-security-incident)
- 2023-11-23: Cloudflare detects the attacker on its self-hosted Atlassian server (https://blog.cloudflare.com/thanksgiving-2023-security-incident)
- 2023-11-14: Attacker begins reconnaissance with credentials from the Okta compromise (https://blog.cloudflare.com/thanksgiving-2023-security-incident)

## Fix brief
# Security brief: Cloudflare 'Thanksgiving 2023' intrusion with tokens left over from the Okta breach

Source: https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion · status: closed (closed Feb 1, 2024) · severity: high · updated Feb 1, 2024

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
A suspected nation-state attacker used one access token and three service account credentials stolen in the October Okta breach, which Cloudflare had failed to rotate, to get into Cloudflare's Atlassian Confluence, Jira and Bitbucket. Cloudflare said customer data and systems were not affected.

Severity detail: Nation-state intrusion using unrotated credentials

- Product: Cloudflare internal Atlassian environment

## Affected versions
- Not specified in the data. Check the advisories below.

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Secrets to rotate
This incident involves possible credential exposure. Rotate any credentials (API keys, tokens, env vars, SSH keys) that were present on affected systems or in affected builds while vulnerable/compromised versions were installed, and review access logs.

## Latest updates
- Feb 1, 2024: Cloudflare publishes its full write-up
- Nov 23, 2023: Cloudflare detects the attacker on its self-hosted Atlassian server
- Nov 14, 2023: Attacker begins reconnaissance with credentials from the Okta compromise

## Write-ups & news
- [Thanksgiving 2023 security incident](https://blog.cloudflare.com/thanksgiving-2023-security-incident)

## Caveats
Related: okta-support-system-breach-2023.

---
Machine-readable: https://pwn.watch/i/cloudflare-thanksgiving-2023-okta-token-intrusion.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.