Everything You Need to Know About Cloudbleed, the Latest Internet Security Disaster
The bad news is that the Cloudflare-backed websites had been leaking data for months before Ormandy noticed the bug. Cloudflare says the earliest data leak dates back to September 2016. It's so far unclear if blackhat hackers had already found the vulnerability and exploited it secretly before Cloudflare fixed its code. Cloudflare's clients include huge companies like Uber, OKCupid, 1Password (Update: 1Password claims its user data is safe), and FitBit.
http://gizmodo.com/everything-you-need-to-know-about-cloudbleed-the-lates-1792710616