This update is meant to give a security status assessment updated with all information we could collect on this incident, as of Friday the 24th of February 13:17 UTC.
One of the biggest global CDN providers had a severe security issue [1][2] which exposed private user data and credentials to the outside world. The full scope of the issue is not yet fully clear.
We have reviewed the services used by Contentful according to a public list [3] of potentially compromised web applications. The only service in this list we are aware of using is Zendesk, whose security staff have assured us that no credentials were leaked on their side.
Contentful itself is NOT using Cloudflare to provide its services, so no data was leaked from Contentful.
We recommend the following:
* To rotate Contentful API Keys that transited through Cloudflare systems (i.e. if you are a customer of Cloudflare and use their product to protect a proxy to the Contentful API)
* Should you be using the same password to access Contentful that you use on other services, we recommend that you change it and use a password that is unique and used only for Contentful.
We will be monitoring the situation and will update accordingly if something changes.