Cloudflare’s Massive Data Leak Explained
Cloudflare, a wide-reaching security firm that protects and encrypts information for more than 5.5 million websites, has disclosed a bizarre breach that has users frantically changing their passwords and login information.
On February 17th, Tavis Ormandy of Google’s Project Zero discovered that Cloudflare’s data was being replicated on different Cloudflare-affiliated websites. Cloudflare’s private user data was literally being copied and pasted into other users’ sessions. A person could be attempting to log in to their Uber account and receive the login information for someone else, or from some other website account that Cloudflare protects.
Ormandy said that “it was bizarre enough that some colleagues around the Project Zero office even got intrigued.”
Ormandy then contacted the Cloudflare team who got the issue resolved in a mere 7 hours… but the damage had already been done. And that’s what’s most disconcerting about the data leak; it could have been parsing and replicating private user information since September of 2016. Meaning that for five-plus months protected data has been randomly spewing over onto other sites, login pages, etc.
Cloudflare insists that they have not heard that any protected data has been used maliciously, but with the chance that your private data may be cached on someone else’s browser session or by search engine bots, it’d be best to go ahead and change your personal information once again.
The Cloudflare “breach or leak?” (it’s really that bizarre) is the most impacting and significant that’s been discovered so far in 2017.
Cloudflare did not release a list of affected sites, but a few known sites affected by the leak include Fitbit, Uber, Yelp, OkCupid, 4Chan, Change.org, Feedly, and the Pirate Bay.
Is My Information Safe?
Fortunately, the chance that it was your own personal data that was replicated and compromised as a result of being fixed to someone else’s website login is extremely low. But just to be safe, we advise that you change your passwords and security questions for any of the aforementioned sites.
If you’re concerned about other sites you frequent being compromised, we’ve included a link here that allows you to see if the site you’re interested in is a Cloudflare affiliate.
As always, we advise you to be extra cautious when signing up for newsletters, website accounts, or any other forms that request your personal information. As you submit your personal information to more websites, just make sure you’re prudent. Each time you do so you’re opening yourself up to a greater risk and increasing your chance of being affected by a breach.
Written by Peter J. Schaub
President & CEO, NeoCertified
