bunny.net Details Response to Infrastructure Provider Security Incident

bunny.net disclosed a security incident involving one of its infrastructure providers, whose third-party server management software was reportedly accessed without authorization. One bunny.net CDN node in Armenia was hosted on a server supplied by that provider. The company said it stopped routing traffic to the server within 20 minutes and removed it from its infrastructure.

Incident and response

Last week, the provider reported unauthorized access involving third-party server management software. After receiving the alert, bunny.net's engineering team stopped routing traffic through the affected server within 20 minutes. The team then reviewed and preserved relevant security logs, securely wiped the server, and revoked its access to other systems. The server was permanently removed from bunny.net's infrastructure. bunny.net said its investigation found no evidence of unauthorized access to the CDN node or its data, and the provider also found no evidence that the server was accessed, though it continues to investigate.

Potential impact

If unauthorized access to the CDN node did occur, the potentially exposed information would have included temporarily cached CDN content, Pull Zone configurations, and TLS certificates stored on that server. bunny.net said no other customer data, including account data, was stored on the server and no internal systems were affected. As a precaution, the company revoked and reissued all TLS certificates for its platform domains, b-cdn.net and bunny.run. Reissuance of managed TLS certificates for custom domains is ongoing and, according to the Oct. 29 update, is expected to be completed by the end of Oct. 31. Existing certificates continue to be served until replaced, and no action is required from customers using managed certificates. Customers who manage their own TLS certificates are advised to revoke and reissue them with new private keys as a precaution.

Next steps

bunny.net said it is closely monitoring its infrastructure and working with the affected provider as the investigation continues. The company said it will provide updates by email and on its status page if any new findings affect customers. Customers with questions or needing help managing TLS certificates can contact bunny.net support.

Sources: status.bunny.net