From their blogpost:
Change your Discord password! And Reddit, Patreon, Medium… a lot of good services use Cloudflare these days.
The PSA
Anyway, sorry to bug you folks on this beautiful Thursday evening, but Safety Jim’s gotta come keep you all woke because the internet can be a scary place.
Unfortunately, there’s a microscopic chance that a bug in Cloudflare, one of our service providers, leaked sensitive Discord data including passwords. Double unfortunately, this is affecting a lot of companies who use Cloudflare to keep you guys safe from the bad guys.
If you want the longer version from our grandmaster code slinger aka our Chief Technical Officer aka Stan, read the message below.
The Important Technical Bits From Our CTO Stan:
Cloudflare disclosed today that they have fixed a bug reported by Google’s Project Zero that was very rarely exposing sensitive information in random requests (0.00003% of all requests) since September 2016. There was no way to target specific information and the exposed information was random.
For those that are unaware Cloudflare is an internet proxy that protects website from malicious attacks such as DDoS. Discord and many other websites were affected by this vulnerability. You can find a full list of websites that are using Cloudflare here.
The likelihood that your information was leaked on any of these sites is very low, but we highly recommend changing your password on Discord and any other sites you use that also use Cloudflare. If you develop against the API on any of the sites, it is also recommended to reset your API key.
At the current time we do not believe performing a forced password reset on all of Discord is necessary given the incredibly low likelihood of impact, but we are continuing to evaluate as we wait for Cloudflare to provide us directly with the full level of impact.
