How are users affected? What should we do apart from changing passwords?
(DigitalOcean is listed here https://github.com/pirate/sites-using-cloudflare)
These answers are provided by our Community. If you find them useful, show some love by clicking the heart. If you run into issues leave a comment, or add your own answer to help others.
Top question, curious of DO’s recommendation.
At a minimum, rotating passwords that could have been exposed would make a lot of sense (and doesn’t hurt anyway).
If you’re running a site through Cloudflare yourself that allows users to login, invalidating sessions (to force a logout) probably wouldn’t hurt, possibly opting to recommend a password change to your users (possibly too drastic). If you’re running a site that storing potentially sensitive information, you would need to consider how you inform your users without making them worry - because, unless you know you were effected, its a precautionary measure. Cloudflare claims they will contact each site that is potentially part of the leak - not sure how true that is.
All of the above is not particular to DO though, so still keen on their input.
Cloudflare claims the discovered approximately 150 of Cloudflare’s customers data has been compromised. and they are contacting each of them individually. unless they confirm you are in that list, i think you dont need to worry that much.
but you could always contact them regarding the issue for details.
Primarily I’m talking about their own login, billing and other data they have from their users, that might be compromised.
they haven’t said their own servers were affected. please correct me if i missed that part.
but you could turn on Two-Factor Authentication on Cloudflare and Digitalocean for login if you haven’t done it yet. i think thats the best you can do on this situation for now.