Bunny CDN Reports Security Incident Involving Third-Party Infrastructure Provider

Incident Overview

Bunny CDN reported a security incident involving one of its infrastructure providers. The provider detected unauthorized access to third-party server management software. A Bunny CDN node, located in Armenia, was hosted on a server supplied by this compromised provider.

Response and Investigation

Upon receiving the alert, Bunny CDN's engineering team immediately stopped routing traffic through the affected server within 20 minutes. The team reviewed security logs, securely wiped the server, and revoked its access to other systems, permanently removing it from their infrastructure. Investigations by both Bunny CDN and the infrastructure provider have not found evidence of unauthorized access to the CDN node or its data, though the possibility is not entirely ruled out.

Potential Data Exposure and Mitigation

If unauthorized access to the CDN node occurred, potentially exposed information would include temporarily cached CDN content, Pull Zone configurations, and TLS certificates stored on that specific server. As a precautionary measure, Bunny CDN revoked and reissued all TLS certificates for its platform domains (b-cdn.net and bunny.run). Reissuance of managed TLS certificates for custom domains is ongoing. Customers managing their own TLS certificates are advised to revoke and reissue them with new private keys.

Customer Data and Future Steps

No other customer data, such as bunny.net account information, was stored on the affected server, and no internal systems were impacted. Bunny CDN is monitoring its infrastructure and collaborating with the provider as the investigation continues. Updates will be provided if new findings affect customers.