Internal validation & live display

Multiple badges & continuous verification

Faster underwriting decisions

https://images.rankiteo.com/companyimages/cloudflare.jpeg

Cloudflare Company CyberSecurity Posture

cloudflare.com

Cloudflare, Inc. (NYSE: NET) is the leading connectivity cloud company. It empowers organizations to make their employees, applications and networks faster and more secure everywhere, while reducing complexity and cost. Cloudflare’s connectivity cloud delivers the most full-featured, unified platform of cloud-native products and developer tools, so any organization can gain the control they need to work, develop, and accelerate their business. Powered by one of the world’s largest and most interconnected networks, Cloudflare blocks billions of threats online for its customers every day. It is trusted by millions of organizations – from the largest brands to entrepreneurs and small businesses to nonprofits, humanitarian groups, and governments across the globe.

Cloudflare A.I CyberSecurity Scoring

Cloudflare

Company Details

Linkedin ID:

cloudflare

Website:

https://www.cloudflare.com

Employees number:

6,146

Number of followers:

1,097,651

NAICS:

541514

Industry Type:

Computer and Network Security

Homepage:

cloudflare.com

IP Addresses:

Company ID:

CLO_2342578

Scan Status:

In-progress

Cloudflare Risk Score (AI oriented)

Between 650 and 699

Cloudflare Computer and Network Security

Updated: 26/11/2025

Powered by our proprietary A.I cyber incident model
Insurance preferes TPRM score to calculate premium

Cloudflare Global Score (TPRM)

XXXX

Cloudflare Computer and Network Security

—

Instant access to detailed risk factors
Benchmark vs. industry & size peers

Vulnerabilities
Findings

Cloudflare Company CyberSecurity News & History

Past Incidents

Attack Types

Entity	Type	Severity	Impact	Seen	Incident Details
Cloudflare	Breach	85	4	8/2024	CLO453090325
Rankiteo Explanation : Attack with significant impact with customers data leaks Description: Cloudflare confirmed it was impacted by a sophisticated supply chain attack targeting the Salesloft Drift-Salesforce integration, part of a broader campaign (UNC6395) that compromised over 700 organizations. Hackers exploited stolen credentials to exfiltrate data from Cloudflare’s Salesforce support cases between August 12–17, 2024, following reconnaissance on August 9. The breach exposed: - Customer contact details (emails, phone numbers, company domains). - Support case contents, including freeform text (potentially containing API tokens, logs, or passwords shared by customers). - 104 Cloudflare API tokens, though no malicious use was detected (all tokens were rotated). While no Cloudflare infrastructure was compromised, the attack risked credential theft for downstream systems (e.g., AWS keys, Snowflake tokens). Cloudflare disabled Drift, purged Salesloft integrations, and notified affected customers, urging credential rotation and forensic reviews. The incident underscores risks from third-party SaaS integrations in enterprise environments.
Cloudflare	Breach	100	4	02/2017	CLO619191123
Rankiteo Explanation : Attack with significant impact with customers data leaks Description: Cloudflare was disclosing a lot of private data, including login passwords and authentication cookies. Uber, Fitbit, 1Password, and OKCupid are just a few of the big names affected by the Cloudbleed security flaw in Cloudflare servers. Because mobile apps are created with the same backends as browsers for HTTPS (SSL/TLS) termination and content delivery, they are likewise impacted by Cloudbleed. The fact that Cloudflare directed Ormandy to the company's bug bounty programme and offered the expert a t-shirt as payment in lieu of cash is highly unusual.
Cloudflare	Cyber Attack	60	1	04/2022	CLO33326522
Rankiteo Explanation : Attack without any consequences Description: Internet infrastructure company Cloudflare suffered one of the largest volumetric distributed denials of service (DDoS) attacks. The attack lasted less than 15 seconds and was launched from a botnet of approximately 6,000 unique bots and originated from 112 countries around the world. The company immediately detected and mitigated a 15.3 million request-per-second (rps) DDoS attack. The attack was aimed at a “crypto launchpad” which is “used to surface Decentralized Finance projects to potential investors.”
Minecraft (Microsoft)	Cyber Attack	60	5	10/2025	CLO0692506101325
Rankiteo Explanation : Attack threatening the organization’s existence Description: A newly disclosed Aisuru IoT botnet attack unleashed a record-breaking 29.6 Tbps DDoS assault, overwhelming major online gaming platforms, including Minecraft, on October 8, 2025. The attack, lasting mere seconds, exploited compromised IoT devices (home routers, IP cameras, DVRs) hosted under US ISPs (AT&T, Comcast, Verizon, T-Mobile, Charter), flooding servers with malicious traffic far exceeding typical mitigation thresholds. While the primary target was gaming services, the sheer scale caused widespread internet disruptions, crippling connectivity for users beyond the gaming community. Cybersecurity journalist Brian Krebs highlighted that such attacks now surpass the defensive capabilities of most organizations, posing systemic risks. Though no data breach or ransomware was involved, the outage disrupted payment processes, user access, and service availability, inflicting reputational damage and financial losses from downtime. The incident underscores the escalating threat of IoT-driven DDoS campaigns targeting high-traffic digital platforms.
Cloudflare	Cyber Attack	100	5	6/2024	CLO717042825
Rankiteo Explanation : Attack threatening the organization’s existence Description: In 2024 Cloudflare mitigated a staggering 21.3 million DDoS attacks—a 358% year-over-year jump—and in Q1 2025 alone it already repelled 20.5 million assaults, including 6.6 million aimed directly at its own infrastructure during an 18-day multi-vector campaign. The surge was driven by a 509% increase in network-layer attacks, while hyper-volumetric floods exploded: over 700 events surpassed 1 Tbps or 1 billion packets per second, averaging eight daily in Q1. Emerging threats like CLDAP reflection attacks rose 3,488% quarter-over-quarter and ESP amplification attacks grew 2,301%. Even specialized gaming servers faced hyper-volumetric onslaughts up to 1.5 billion packets per second. Most alarmingly, Cloudflare disclosed it withstood a record-breaking 5.8 Tbps DDoS blast lasting 45 seconds, eclipsing its previous 5.6 Tbps record. Although fully mitigated, these figures underscore unprecedented scale and sophistication that threaten service availability and corporate stability across industries.
Cloudflare	Cyber Attack	100	8	10/2023	CLO420051124
Rankiteo Explanation : Attack that could bring to a war Description: On October 7, 2023, amid a real-world conflict, Israeli websites providing critical information and alerts to civilians on rocket attacks were hit by a series of DDoS attacks. Cloudflare systems detected and mitigated these attacks, which were as intense as 1M requests per second. Pro-Palestinian hacktivist groups also targeted various Israeli websites and apps, including compromising an app alerting civilians about incoming rockets by sending fake alerts. Cloudflare's Threat Operations team discovered malicious mobile applications impersonating legitimate alert apps, which could access sensitive user data. These cyberattacks occurred alongside physical threats, creating a complex situation for Cloudflare and the affected organizations to manage, emphasizing the intersection of physical and cybersecurity domains during times of conflict.
Cloudflare	Cyber Attack	100	6	6/2025	CLO900062425
Rankiteo Explanation : Attack threatening the economy of geographical region Description: La firme de sécurité réseau signale une attaque DDoS d’une vitesse de 7,3 térabits par seconde. Il s’agirait de la plus importante attaque jamais enregistrée sur la plateforme Cloudflare. L’attaque a eu lieu en mai et visait un hébergeur utilisant Magic Transit de Cloudflare pour protéger son réseau IP. Elle a dépassé le précédent record de 5,6 Tbit/s. L’attaque DDoS a transféré quelque 37,4 téraoctets de données en 45 secondes. Ces données provenaient de 122.145 adresses IP disséminées dans 161 pays. Les hébergeurs et les infrastructures internet clés sont souvent la cible d’attaques DDoS. Cloudflare même publie régulièrement des analyses à ce sujet. Elle a notifié que plus de 13,5 millions d’attaques DDoS ont été lancées en janvier et février 2025 contre son infrastructure et ses hébergeurs protégés par Cloudflare. Le précédent pic mesuré par Cloudflare était une attaque DDoS remontant à octobre dernier.
Cloudflare	Ransomware	100		5/2025	CLO1006052925
Rankiteo Explanation : Attack threatening the organization’s existence Description: Cybersecurity researchers have identified a growing trend among ransomware affiliates and advanced persistent threat actors who are leveraging Cloudflare’s legitimate tunneling service, Cloudflared, to establish covert access channels into compromised networks. This sophisticated technique allows attackers to maintain persistent access while evading traditional network security controls that typically flag suspicious outbound connections. The exploitation of Cloudflared tunnels has emerged as a preferred persistence mechanism due to the service’s inherent design, which encapsulates data in additional protocols that only the tunnel endpoints can decrypt. This creates a secure communication channel that appears as legitimate traffic to security monitoring systems, effectively providing attackers with what amounts to local network access from remote locations.
Cloudflare	Vulnerability	60	2	5/2025	CLO3732737111825
Rankiteo Explanation : Attack limited on finance or reputation Description: 'Cloudflare experienced an internal server error across its global network, leading to potential disruptions in web traffic, security services, and DNS resolution for numerous websites and online services relying on its infrastructure. While the exact cause was not detailed in the brief report, such errors can stem from misconfigurations, software bugs, or infrastructure overloads, temporarily degrading performance or availability.The outage may have affected businesses dependent on Cloudflare’s CDN, DDoS protection, or firewall services, causing intermittent downtime, slower load times, or failed transactions for end-users. E-commerce platforms, SaaS providers, and media sites could have faced revenue loss, customer frustration, or reputational harm due to unreliable access. Critical services like APIs, authentication systems, or payment gateways might have also been impacted if routed through Cloudflare’s network.Though no data breach or malicious attack was confirmed, the incident highlights vulnerabilities in cloud-based dependencies, where a single provider’s failure can cascade across industries. The lack of transparency about the root cause or duration could further erode user trust, especially if recurring issues persist. Recovery likely involved internal debugging, failover mechanisms, or rolling restarts, but the broader operational and financial repercussions for affected clients remain unquantified.'
Cloudflare (or the website owner using Cloudflare)	Vulnerability	60	2	5/2025	CLO4892148111525
Rankiteo Explanation : Attack limited on finance or reputation Description: The incident involves Cloudflare failing to establish an SSL/TLS connection to the origin server of a website, likely due to misconfigured cipher suites or incompatible SSL settings. This disruption prevents visitors from securely accessing the site, leading to potential downtime, loss of trust, and reputational damage for the affected business. While no direct data breach or cyberattack is confirmed, the outage could result in financial losses if the website relies on e-commerce, subscriptions, or ad revenue. Customers may abandon transactions, seek alternatives, or perceive the company as unreliable. Prolonged SSL failures might also trigger SEO penalties if search engines interpret the downtime as poor site health. The root cause—whether a misconfiguration, expired certificate, or unsupported encryption protocols—highlights a vulnerability in the security infrastructure. If exploited, such weaknesses could enable man-in-the-middle attacks or data interception. However, in this case, the immediate impact is operational disruption rather than confirmed data compromise.
Cloudflare	Vulnerability	100	5	5/2025	CLO1432114111825
Rankiteo Explanation : Attack threatening the organization’s existence Description: Cloudflare experienced an internal server error across its global network, leading to service disruptions for websites, APIs, and online services relying on its infrastructure. The outage likely caused temporary unavailability of critical web applications, e-commerce platforms, and cloud-based services for end-users and businesses. While no data breach or malicious attack was confirmed, the incident disrupted operations for countless dependent entities, potentially resulting in financial losses due to downtime—particularly for high-traffic or transaction-heavy services. The error may have also eroded user trust in Cloudflare’s reliability, though no permanent data loss or security compromise was reported. The root cause appeared to be a technical failure rather than a cyberattack, but the operational impact was widespread, affecting global internet traffic routing and content delivery.

Cloudflare

Breach

Severity: 85

Impact: 4

Seen: 8/2024

Blog:

CLO453090325

Rankiteo Explanation

Attack with significant impact with customers data leaks

Description: Cloudflare confirmed it was impacted by a sophisticated **supply chain attack** targeting the **Salesloft Drift-Salesforce integration**, part of a broader campaign (UNC6395) that compromised over **700 organizations**. Hackers exploited stolen credentials to exfiltrate data from Cloudflare’s **Salesforce support cases** between **August 12–17, 2024**, following reconnaissance on **August 9**. The breach exposed: - **Customer contact details** (emails, phone numbers, company domains). - **Support case contents**, including **freeform text** (potentially containing **API tokens, logs, or passwords** shared by customers). - **104 Cloudflare API tokens**, though no malicious use was detected (all tokens were rotated). While **no Cloudflare infrastructure was compromised**, the attack risked **credential theft for downstream systems** (e.g., AWS keys, Snowflake tokens). Cloudflare disabled Drift, purged Salesloft integrations, and notified affected customers, urging **credential rotation** and forensic reviews. The incident underscores risks from **third-party SaaS integrations** in enterprise environments.

Cloudflare

Breach

Severity: 100

Impact: 4

Seen: 02/2017

Blog:

CLO619191123

Rankiteo Explanation

Attack with significant impact with customers data leaks

Description: Cloudflare was disclosing a lot of private data, including login passwords and authentication cookies. Uber, Fitbit, 1Password, and OKCupid are just a few of the big names affected by the Cloudbleed security flaw in Cloudflare servers. Because mobile apps are created with the same backends as browsers for HTTPS (SSL/TLS) termination and content delivery, they are likewise impacted by Cloudbleed. The fact that Cloudflare directed Ormandy to the company's bug bounty programme and offered the expert a t-shirt as payment in lieu of cash is highly unusual.

Cloudflare

Cyber Attack

Severity: 60

Impact: 1

Seen: 04/2022

Blog:

CLO33326522

Rankiteo Explanation

Attack without any consequences

Description: Internet infrastructure company Cloudflare suffered one of the largest volumetric distributed denials of service (DDoS) attacks. The attack lasted less than 15 seconds and was launched from a botnet of approximately 6,000 unique bots and originated from 112 countries around the world. The company immediately detected and mitigated a 15.3 million request-per-second (rps) DDoS attack. The attack was aimed at a “crypto launchpad” which is “used to surface Decentralized Finance projects to potential investors.”

Minecraft (Microsoft)

Cyber Attack

Severity: 60

Impact: 5

Seen: 10/2025

Blog:

CLO0692506101325

Rankiteo Explanation

Attack threatening the organization’s existence

Description: A newly disclosed **Aisuru IoT botnet** attack unleashed a record-breaking **29.6 Tbps DDoS assault**, overwhelming major online gaming platforms, including **Minecraft**, on **October 8, 2025**. The attack, lasting mere seconds, exploited **compromised IoT devices** (home routers, IP cameras, DVRs) hosted under **US ISPs (AT&T, Comcast, Verizon, T-Mobile, Charter)**, flooding servers with malicious traffic far exceeding typical mitigation thresholds. While the primary target was gaming services, the sheer scale caused **widespread internet disruptions**, crippling connectivity for users beyond the gaming community. Cybersecurity journalist **Brian Krebs** highlighted that such attacks now surpass the defensive capabilities of most organizations, posing systemic risks. Though no data breach or ransomware was involved, the **outage disrupted payment processes, user access, and service availability**, inflicting **reputational damage** and **financial losses** from downtime. The incident underscores the escalating threat of **IoT-driven DDoS campaigns** targeting high-traffic digital platforms.

Cloudflare

Cyber Attack

Severity: 100

Impact: 5

Seen: 6/2024

Blog:

CLO717042825

Rankiteo Explanation

Attack threatening the organization’s existence

Description: In 2024 Cloudflare mitigated a staggering 21.3 million DDoS attacks—a 358% year-over-year jump—and in Q1 2025 alone it already repelled 20.5 million assaults, including 6.6 million aimed directly at its own infrastructure during an 18-day multi-vector campaign. The surge was driven by a 509% increase in network-layer attacks, while hyper-volumetric floods exploded: over 700 events surpassed 1 Tbps or 1 billion packets per second, averaging eight daily in Q1. Emerging threats like CLDAP reflection attacks rose 3,488% quarter-over-quarter and ESP amplification attacks grew 2,301%. Even specialized gaming servers faced hyper-volumetric onslaughts up to 1.5 billion packets per second. Most alarmingly, Cloudflare disclosed it withstood a record-breaking 5.8 Tbps DDoS blast lasting 45 seconds, eclipsing its previous 5.6 Tbps record. Although fully mitigated, these figures underscore unprecedented scale and sophistication that threaten service availability and corporate stability across industries.

Cloudflare

Cyber Attack

Severity: 100

Impact: 8

Seen: 10/2023

Blog:

CLO420051124

Rankiteo Explanation

Attack that could bring to a war

Description: On October 7, 2023, amid a real-world conflict, Israeli websites providing critical information and alerts to civilians on rocket attacks were hit by a series of DDoS attacks. Cloudflare systems detected and mitigated these attacks, which were as intense as 1M requests per second. Pro-Palestinian hacktivist groups also targeted various Israeli websites and apps, including compromising an app alerting civilians about incoming rockets by sending fake alerts. Cloudflare's Threat Operations team discovered malicious mobile applications impersonating legitimate alert apps, which could access sensitive user data. These cyberattacks occurred alongside physical threats, creating a complex situation for Cloudflare and the affected organizations to manage, emphasizing the intersection of physical and cybersecurity domains during times of conflict.

Cloudflare

Cyber Attack

Severity: 100

Impact: 6

Seen: 6/2025

Blog:

CLO900062425

Rankiteo Explanation

Attack threatening the economy of geographical region

Description: La firme de sécurité réseau signale une attaque DDoS d’une vitesse de 7,3 térabits par seconde. Il s’agirait de la plus importante attaque jamais enregistrée sur la plateforme Cloudflare. L’attaque a eu lieu en mai et visait un hébergeur utilisant Magic Transit de Cloudflare pour protéger son réseau IP. Elle a dépassé le précédent record de 5,6 Tbit/s. L’attaque DDoS a transféré quelque 37,4 téraoctets de données en 45 secondes. Ces données provenaient de 122.145 adresses IP disséminées dans 161 pays. Les hébergeurs et les infrastructures internet clés sont souvent la cible d’attaques DDoS. Cloudflare même publie régulièrement des analyses à ce sujet. Elle a notifié que plus de 13,5 millions d’attaques DDoS ont été lancées en janvier et février 2025 contre son infrastructure et ses hébergeurs protégés par Cloudflare. Le précédent pic mesuré par Cloudflare était une attaque DDoS remontant à octobre dernier.

Cloudflare

Ransomware

Severity: 100

Impact:

Seen: 5/2025

Blog:

CLO1006052925

Rankiteo Explanation

Attack threatening the organization’s existence

Description: Cybersecurity researchers have identified a growing trend among ransomware affiliates and advanced persistent threat actors who are leveraging Cloudflare’s legitimate tunneling service, Cloudflared, to establish covert access channels into compromised networks. This sophisticated technique allows attackers to maintain persistent access while evading traditional network security controls that typically flag suspicious outbound connections. The exploitation of Cloudflared tunnels has emerged as a preferred persistence mechanism due to the service’s inherent design, which encapsulates data in additional protocols that only the tunnel endpoints can decrypt. This creates a secure communication channel that appears as legitimate traffic to security monitoring systems, effectively providing attackers with what amounts to local network access from remote locations.

Cloudflare

Vulnerability

Severity: 60

Impact: 2

Seen: 5/2025

Blog:

CLO3732737111825

Rankiteo Explanation

Attack limited on finance or reputation

Description: 'Cloudflare experienced an **internal server error** across its global network, leading to potential disruptions in web traffic, security services, and DNS resolution for numerous websites and online services relying on its infrastructure. While the exact cause was not detailed in the brief report, such errors can stem from misconfigurations, software bugs, or infrastructure overloads, temporarily degrading performance or availability.The outage may have affected businesses dependent on Cloudflare’s CDN, DDoS protection, or firewall services, causing intermittent downtime, slower load times, or failed transactions for end-users. E-commerce platforms, SaaS providers, and media sites could have faced revenue loss, customer frustration, or reputational harm due to unreliable access. Critical services like APIs, authentication systems, or payment gateways might have also been impacted if routed through Cloudflare’s network.Though no data breach or malicious attack was confirmed, the incident highlights vulnerabilities in cloud-based dependencies, where a single provider’s failure can cascade across industries. The lack of transparency about the root cause or duration could further erode user trust, especially if recurring issues persist. Recovery likely involved internal debugging, failover mechanisms, or rolling restarts, but the broader operational and financial repercussions for affected clients remain unquantified.'

Cloudflare (or the website owner using Cloudflare)

Vulnerability

Severity: 60

Impact: 2

Seen: 5/2025

Blog:

CLO4892148111525

Rankiteo Explanation

Attack limited on finance or reputation

Description: The incident involves Cloudflare failing to establish an **SSL/TLS connection** to the origin server of a website, likely due to misconfigured cipher suites or incompatible SSL settings. This disruption prevents visitors from securely accessing the site, leading to potential **downtime, loss of trust, and reputational damage** for the affected business. While no direct data breach or cyberattack is confirmed, the outage could result in **financial losses** if the website relies on e-commerce, subscriptions, or ad revenue. Customers may abandon transactions, seek alternatives, or perceive the company as unreliable. Prolonged SSL failures might also trigger **SEO penalties** if search engines interpret the downtime as poor site health. The root cause—whether a **misconfiguration, expired certificate, or unsupported encryption protocols**—highlights a **vulnerability in the security infrastructure**. If exploited, such weaknesses could enable man-in-the-middle attacks or data interception. However, in this case, the immediate impact is **operational disruption** rather than confirmed data compromise.

Cloudflare

Vulnerability

Severity: 100

Impact: 5

Seen: 5/2025

Blog:

CLO1432114111825

Rankiteo Explanation

Attack threatening the organization’s existence

Description: Cloudflare experienced an **internal server error** across its global network, leading to service disruptions for websites, APIs, and online services relying on its infrastructure. The outage likely caused temporary unavailability of critical web applications, e-commerce platforms, and cloud-based services for end-users and businesses. While no data breach or malicious attack was confirmed, the incident disrupted operations for countless dependent entities, potentially resulting in financial losses due to downtime—particularly for high-traffic or transaction-heavy services. The error may have also eroded user trust in Cloudflare’s reliability, though no permanent data loss or security compromise was reported. The root cause appeared to be a technical failure rather than a cyberattack, but the operational impact was widespread, affecting global internet traffic routing and content delivery.

Cloudflare Company Scoring based on AI Models

Cyber Incidents Likelihood 3 - 6 - 9 months

🔒

Incident Predictions locked

Access Monitoring Plan

A.I Risk Score Likelihood 3 - 6 - 9 months

🔒

A.I. Risk Score Predictions locked

Access Monitoring Plan

Underwriter Stats for Cloudflare

Incidents vs Computer and Network Security Industry Average (This Year)

Cloudflare has 1204.35% more incidents than the average of same-industry companies with at least one recorded incident.

Incidents vs All-Companies Average (This Year)

Cloudflare has 837.5% more incidents than the average of all companies with at least one recorded incident.

Incident Types Cloudflare vs Computer and Network Security Industry Avg (This Year)

Cloudflare reported 6 incidents this year: 2 cyber attacks, 1 ransomware, 3 vulnerabilities, 0 data breaches, compared to industry peers with at least 1 incident.

Incident History — Cloudflare (X = Date, Y = Severity)

Cloudflare cyber incidents detection timeline including parent company and subsidiaries

Cloudflare Company Subsidiaries

Cloudflare Similar Companies

CrowdStrike

crowdstrike.com

CrowdStrike (Nasdaq: CRWD), a global cybersecurity leader, has redefined modern security with the world’s most advanced cloud-native platform for protecting critical areas of enterprise risk — endpoints and cloud workloads, identity and data. Powered by the CrowdStrike Security Cloud and world-clas

Security Report → Compare→

Palo Alto Networks

paloaltonetworks.com

Palo Alto Networks, the global cybersecurity leader, is shaping the cloud-centric future with technology that is transforming the way people and organizations operate. Our mission is to be the cybersecurity partner of choice, protecting our digital way of life. We help address the world's greatest s

Security Report → Compare→

Cloudflare CyberSecurity News

November 20, 2025 11:00 AM

Cloudflare blames database, Crypto heist takedown

Cloudflare's worst outage since 2019 knocked major websites offline for hours on Tuesday, and the company now says it wasn't a cyberattack...

Read Article →

November 19, 2025 10:04 PM

Cloudflare Reveals Cause of Massive Internet Outage

Read Article →

November 19, 2025 09:10 PM

Lesson from the Cloudflare outage: Don’t jump to conclusions about external threats

COMMENTARY: A widespread Cloudflare service interruption Nov. 18 took down hundreds of websites for a few hours, causing significant...

Read Article →

November 19, 2025 06:22 PM

Cloudflare outage spotlights systemic risks in cloud resilience

Yesterday's Cloudflare outage triggered widespread 5xx errors, exposing systemic risks in cloud resilience and sparking calls for stronger...

Read Article →

November 19, 2025 04:01 PM

What triggered the cloudflare outage that disrupted major websites?

A little-known issue, a 'latent bug,' is being blamed for the massive disruption that impacted major platforms like X, ChatGPT,...

Read Article →

November 19, 2025 03:57 PM

Cloudflare Blames Outage on Internal Configuration Error

Initially though to be a DDoS attack, the incident was actually due to a routine change in permissions that caused widespread software...

Read Article →

November 19, 2025 01:55 PM

Cloudflare outage reveals vulnerability of cybersecurity consolidation

When one major cybersecurity firm goes down, like Cloudflare did this week, it can disrupt large swaths of the internet.

Read Article →

November 19, 2025 10:37 AM

Inside Outages: What Happens When Cloudflare Goes Down?

When Cloudflare's systems – protecting 20% of global websites – crashed, it revealed a worrying trend about global internet infrastructure.

Read Article →

November 19, 2025 08:52 AM

Everything to know about Cloudflare, the service going down that took half the internet with it

Cloudflare experienced an outage on Tuesday, causing hundreds of websites to crash, including the X platform, Spotify, Knava, ChatGPT,...

Read Article →

Frequently Asked Questions

Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.

Cloudflare CyberSecurity History Information

Official Website of Cloudflare

The official website of Cloudflare is https://www.cloudflare.com.

Cloudflare’s AI-Generated Cybersecurity Score

According to Rankiteo, Cloudflare’s AI-generated cybersecurity score is 672, reflecting their Weak security posture.

How many security badges does Cloudflare’ have ?

According to Rankiteo, Cloudflare currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.

Does Cloudflare have SOC 2 Type 1 certification ?

According to Rankiteo, Cloudflare is not certified under SOC 2 Type 1.

Does Cloudflare have SOC 2 Type 2 certification ?

According to Rankiteo, Cloudflare does not hold a SOC 2 Type 2 certification.

Does Cloudflare comply with GDPR ?

According to Rankiteo, Cloudflare is not listed as GDPR compliant.

Does Cloudflare have PCI DSS certification ?

According to Rankiteo, Cloudflare does not currently maintain PCI DSS compliance.

Does Cloudflare comply with HIPAA ?

According to Rankiteo, Cloudflare is not compliant with HIPAA regulations.

Does Cloudflare have ISO 27001 certification ?

According to Rankiteo,Cloudflare is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.

Industry Classification of Cloudflare

Cloudflare operates primarily in the Computer and Network Security industry.

Number of Employees at Cloudflare

Cloudflare employs approximately 6,146 people worldwide.

Subsidiaries Owned by Cloudflare

Cloudflare presently has no subsidiaries across any sectors.

Cloudflare’s LinkedIn Followers

Cloudflare’s official LinkedIn profile has approximately 1,097,651 followers.

NAICS Classification of Cloudflare

Cloudflare is classified under the NAICS code 541514, which corresponds to Others.

Cloudflare’s Presence on Crunchbase

No, Cloudflare does not have a profile on Crunchbase.

Cloudflare’s Presence on LinkedIn

Yes, Cloudflare maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/cloudflare.

Cybersecurity Incidents Involving Cloudflare

As of December 01, 2025, Rankiteo reports that Cloudflare has experienced 11 cybersecurity incidents.

Number of Peer and Competitor Companies

Cloudflare has an estimated 2,858 peer or competitor companies worldwide.

What types of cybersecurity incidents have occurred at Cloudflare ?

Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability, Ransomware, Cyber Attack and Breach.

How does Cloudflare detect and respond to cybersecurity incidents ?

Detection and Response: The company detects and responds to cybersecurity incidents through an incident response plan activated with cloudflare (august 23), incident response plan activated with zscaler, incident response plan activated with palo alto networks, incident response plan activated with salesloft, incident response plan activated with google, and third party assistance with mandiant (for salesloft investigation), third party assistance with google threat intelligence, and containment measures with salesloft revoked all drift-to-salesforce connections (pre-notification), containment measures with cloudflare disabled drift user accounts and purged salesloft software, containment measures with google revoked compromised workspace tokens and disabled drift integration, containment measures with salesloft took drift platform offline and paused salesforce integrations, and remediation measures with credential rotation (cloudflare rotated 104 api tokens), remediation measures with customer notifications via email/dashboard banners (cloudflare, palo alto networks), remediation measures with forensic investigations across affected organizations, remediation measures with salesforce instance audits for unauthorized access, and recovery measures with re-establishing secure integrations (timeline unclear), recovery measures with enhanced monitoring of salesforce/salesloft environments, and communication strategy with public blog posts by cloudflare, zscaler, palo alto networks, communication strategy with customer advisories with actionable steps (e.g., disconnect salesloft, rotate credentials), communication strategy with google’s updated threat advisory (august 2024), and enhanced monitoring with likely implemented by affected companies (not detailed), and third party assistance with cloudflare support (implied via troubleshooting link), and remediation measures with review and update ssl configuration on the origin server to ensure cipher suite compatibility with cloudflare, and communication strategy with advisory for visitors to retry access; guidance for website owners to troubleshoot via provided link, and recovery measures with automated or manual recovery (implied by 'try again in a few minutes'), and communication strategy with generic user-facing error message, and recovery measures with users advised to retry after a few minutes (implied automatic recovery), and communication strategy with generic error message displayed to users..

Incident Details

Can you provide details on each incident ?

Incident : DDoS Attack

Exposure

Impact

Title: Cloudflare Suffers Massive DDoS Attack

Description: Internet infrastructure company Cloudflare suffered one of the largest volumetric distributed denials of service (DDoS) attacks.

Type: DDoS Attack

Attack Vector: Distributed Denial of Service (DDoS)

Incident : Data Breach

Exposure

Impact

Title: Cloudbleed Security Flaw in Cloudflare Servers

Type: Data Breach

Attack Vector: Cloudbleed Security Flaw

Vulnerability Exploited: Cloudbleed

Incident : DDoS, Hacktivism, Malware

Exposure

Impact

Title: DDoS and Hacktivist Attacks on Israeli Websites and Apps

Description: On October 7, 2023, Israeli websites providing critical information and alerts to civilians on rocket attacks were hit by a series of DDoS attacks. Cloudflare systems detected and mitigated these attacks, which were as intense as 1M requests per second. Pro-Palestinian hacktivist groups also targeted various Israeli websites and apps, including compromising an app alerting civilians about incoming rockets by sending fake alerts. Cloudflare's Threat Operations team discovered malicious mobile applications impersonating legitimate alert apps, which could access sensitive user data. These cyberattacks occurred alongside physical threats, creating a complex situation for Cloudflare and the affected organizations to manage, emphasizing the intersection of physical and cybersecurity domains during times of conflict.

Date Detected: 2023-10-07

Type: DDoS, Hacktivism, Malware

Attack Vector: DDoSMalicious mobile applications

Threat Actor: Pro-Palestinian hacktivist groups

Motivation: Political, Disruption

Incident : DDoS

Exposure

Impact

Title: Cloudflare DDoS Attacks 2024-2025

Type: DDoS

Attack Vector: network-layer attacksCLDAP reflection attacksESP amplification attacks

Incident : Ransomware

Exposure

Impact

Title: Abuse of Cloudflare’s Tunneling Service by Ransomware Groups

Description: Cybersecurity researchers have identified a growing trend among ransomware affiliates and advanced persistent threat actors leveraging Cloudflare’s legitimate tunneling service, Cloudflared, to establish covert access channels into compromised networks. This sophisticated technique allows attackers to maintain persistent access while evading traditional network security controls.

Type: Ransomware

Attack Vector: VPN exploitationRemote desktop protocol attacksCloudflared tunnels

Threat Actor: BlackSuitRoyalAkiraScattered SpiderMedusaHunter International

Motivation: Maintain persistent access and establish command and control channels

Incident : DDoS Attack

Exposure

Impact

Title: Record-Breaking DDoS Attack on Cloudflare Platform

Description: A network security firm reported a DDoS attack with a speed of 7.3 terabits per second, the largest ever recorded on the Cloudflare platform.

Date Detected: May 2023

Type: DDoS Attack

Attack Vector: Distributed Denial of Service (DDoS)

Incident : Data Breach

Exposure

Impact

Title: Widespread Data Theft Campaign Targeting Salesforce via Salesloft Drift Integration

Description: A sophisticated supply chain attack targeted hundreds of organizations globally by exploiting the Salesloft Drift integration with Salesforce. Threat actors (tracked as UNC6395 by Mandiant) exfiltrated sensitive customer data, including AWS access keys, Snowflake tokens, and business contact details, between August 8–18, 2024. Affected companies include Cloudflare, Zscaler, Palo Alto Networks, and potentially over 700 others. The attack leveraged stolen credentials and compromised authentication tokens within the Drift AI chatbot platform, which Salesloft acquired in 2023. Salesloft has since taken Drift offline and paused Salesforce integrations as a precautionary measure.

Date Detected: 2024-08-13 (initial warnings by Mandiant)

Date Publicly Disclosed: 2024-08-27 (confirmations by Cloudflare, Zscaler, Palo Alto Networks)

Type: Data Breach

Attack Vector: Compromised Third-Party Integration (Salesloft Drift)Stolen Authentication TokensAPI Abuse

Vulnerability Exploited: Weak Authentication Token Management in DriftOver-Permissive Salesforce Integrations

Threat Actor: UNC6395 (tracked by Mandiant)

Motivation: Credential Harvesting for Further AttacksData Exfiltration for Resale/ExploitationPotential Espionage or Financial Gain

Incident : DDoS Attack

Exposure

Impact

Title: Massive DDoS Attack by Aisuru IoT Botnet Disrupts Major Online Gaming Platforms

Description: A newly disclosed attack campaign linked to the IoT botnet Aisuru led to a massive surge in malicious traffic, temporarily disrupting major online gaming platforms with nearly 29.6 Tbps of DDoS packets. The incident lasted only a few seconds on October 8, 2025, primarily leveraging compromised devices (home routers, IP cameras, and DVRs) hosted under leading US ISPs like AT&T, Comcast, Verizon, T-Mobile, and Charter. The attacks targeted ISPs serving online gaming communities such as Minecraft, resulting in widespread Internet disruption beyond the gaming sector.

Date Detected: 2025-10-08

Type: DDoS Attack

Attack Vector: Compromised IoT DevicesDDoS Amplification

Threat Actor: Aisuru IoT Botnet

Incident : Service Disruption / Configuration Error

Exposure

Impact

Title: Cloudflare SSL Connection Failure to Origin Server

Description: Cloudflare is unable to establish an SSL connection to the origin server. This issue is attributed to an incompatible SSL configuration, potentially due to no shared cipher suites between Cloudflare and the origin server. Visitors are advised to retry accessing the website after a few minutes, while website owners are directed to troubleshoot their SSL configuration for compatibility with Cloudflare.

Type: Service Disruption / Configuration Error

Incident : Service Disruption / Internal Server Error

Exposure

Impact

Title: Cloudflare Internal Server Error

Description: There is an internal server error on Cloudflare's network. Users are advised to try again in a few minutes.

Type: Service Disruption / Internal Server Error

Incident : Service Disruption / Internal Server Error

Exposure

Impact

Title: Cloudflare Internal Server Error

Description: There is an internal server error on Cloudflare's network. Users are advised to try again in a few minutes.

Type: Service Disruption / Internal Server Error

What are the most common types of attacks the company has faced ?

Common Attack Types: The most common types of attacks the company has faced is Cyber Attack.

How does the company identify the attack vectors used in incidents ?

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Mobile applications, Compromised Salesloft Drift authentication tokens (likely via phishing or credential stuffing), Compromised IoT Devices (home routers, IP cameras and DVRs).

Impact of the Incidents

What was the impact of each incident ?

Incident : DDoS Attack CLO33326522

Systems Affected: Crypto Launchpad

Incident : Data Breach CLO619191123

Data Compromised: Login passwords, Authentication cookies

Systems Affected: Cloudflare serversmobile apps

Incident : DDoS, Hacktivism, Malware CLO420051124

Data Compromised: Sensitive user data

Systems Affected: Israeli websitesMobile alert apps

Operational Impact: Fake alerts sent, User trust compromised

Brand Reputation Impact: Potential loss of trust

Identity Theft Risk: High

Incident : DDoS CLO717042825

Operational Impact: threaten service availability and corporate stability across industries

Incident : DDoS Attack CLO900062425

Systems Affected: Hosting provider using Cloudflare's Magic Transit

Incident : Data Breach CLO453090325

Data Compromised: Customer business contact details (names, emails, phone numbers, locations), Salesforce case data (subject lines, body text with potential keys/secrets), Aws access keys, Snowflake access tokens, Zscaler product licensing/commercial information, Support case logs (may include tokens/passwords)

Systems Affected: Salesforce instances (via Salesloft Drift integration)Google Workspace accounts (limited to Drift-integrated emails)Cloudflare API tokens (104 identified, rotated)

Downtime: ['Salesloft Drift platform taken offline', 'Salesforce-Salesloft integrations paused']

Operational Impact: Forensic investigations across hundreds of organizationsCredential rotation campaignsDisruption of customer support workflows (Salesforce case management)Temporary loss of Drift chatbot functionality

Customer Complaints: ['Potential increase due to exposed sensitive data in support cases']

Brand Reputation Impact: High (affects trust in Salesforce ecosystem and third-party integrations)Public disclosures by major tech firms may amplify scrutiny

Legal Liabilities: Potential GDPR/CCPA violations for exposed PIIContractual breaches with customers

Identity Theft Risk: ['Moderate (business contact details exposed)', 'Low for direct financial fraud (no payment data confirmed)']

Payment Information Risk: None reported

Incident : DDoS Attack CLO0692506101325

Systems Affected: Online Gaming Platforms (e.g., Minecraft)ISPs (AT&T, Comcast, Verizon, T-Mobile, Charter)

Downtime: Few seconds (but widespread disruption)

Operational Impact: Temporary disruption of major online gaming platforms and broader Internet services

Incident : Service Disruption / Configuration Error CLO4892148111525

Systems Affected: Origin server SSL configuration

Downtime: Temporary (visitors advised to retry in a few minutes)

Operational Impact: Potential disruption in website accessibility for end-users relying on Cloudflare’s proxy services

Brand Reputation Impact: Minor (if prolonged or recurrent)

Incident : Service Disruption / Internal Server Error CLO1432114111825

Systems Affected: Cloudflare's network infrastructure

Downtime: Temporary (users advised to retry in a few minutes)

Operational Impact: Service interruption for users relying on Cloudflare's network

Brand Reputation Impact: Minor (if prolonged or frequent)

Incident : Service Disruption / Internal Server Error CLO3732737111825

Systems Affected: Cloudflare's network infrastructure

Downtime: Temporary (users advised to retry in a few minutes)

Operational Impact: Service interruption for users relying on Cloudflare's network

Brand Reputation Impact: Minor (short-term service disruption)

What types of data are most commonly compromised in incidents ?

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Login Passwords, Authentication Cookies, , Sensitive user data, Business Contact Information, Salesforce Case Metadata/Content, Authentication Tokens (Aws, Snowflake, Api Keys), Support Logs (May Include Sensitive Customer-Provided Data) and .

Which entities were affected by each incident ?

Incident : DDoS Attack CLO33326522

Entity Name: Cloudflare

Entity Type: Company

Industry: Internet Infrastructure

Incident : Data Breach CLO619191123

Entity Name: Uber

Entity Type: Company

Industry: Transportation

Incident : Data Breach CLO619191123

Entity Name: Fitbit

Entity Type: Company

Industry: Health & Fitness

Incident : Data Breach CLO619191123

Entity Name: 1Password

Entity Type: Company

Industry: Security

Incident : Data Breach CLO619191123

Entity Name: OKCupid

Entity Type: Company

Industry: Dating

Incident : DDoS, Hacktivism, Malware CLO420051124

Entity Name: Cloudflare

Entity Type: Technology Company

Industry: Cybersecurity

Location: Global

Customers Affected: Israeli civilians

Incident : DDoS CLO717042825

Entity Name: Cloudflare

Entity Type: Company

Industry: Technology

Incident : DDoS Attack CLO900062425

Entity Name: Cloudflare

Entity Type: Network Security Firm

Industry: Technology

Location: Global

Incident : Data Breach CLO453090325

Entity Name: Cloudflare

Entity Type: Internet Infrastructure Company

Industry: Cybersecurity/Cloud Services

Location: San Francisco, CA, USA

Size: ~3,000 employees (2024)

Customers Affected: Limited subset (those with data in Salesforce cases)

Incident : Data Breach CLO453090325

Entity Name: Zscaler

Entity Type: Cybersecurity Firm

Industry: Cloud Security

Location: San Jose, CA, USA

Size: ~5,000 employees (2024)

Customers Affected: Customers with support cases or licensing data exposed

Incident : Data Breach CLO453090325

Entity Name: Palo Alto Networks

Entity Type: Cybersecurity Firm

Industry: Network Security

Location: Santa Clara, CA, USA

Size: ~12,000 employees (2024)

Customers Affected: Limited number with sensitive data in Salesforce

Incident : Data Breach CLO453090325

Entity Name: Salesloft

Entity Type: Sales Engagement Platform

Industry: SaaS/CRM

Location: Atlanta, GA, USA

Size: ~1,000 employees (2024)

Customers Affected: Hundreds of organizations using Drift-Salesforce integration

Incident : Data Breach CLO453090325

Entity Name: Google (Workspace)

Entity Type: Tech Giant

Industry: Cloud/Enterprise Software

Location: Mountain View, CA, USA

Size: ~190,000 employees (2024)

Customers Affected: Workspace administrators with Drift-integrated accounts

Incident : Data Breach CLO453090325

Entity Name: Over 700 Unnamed Companies

Entity Type: Varied (B2B organizations)

Industry: Multiple (tech, finance, healthcare, etc.)

Location: Global