Cloudflare reported blocking a 71 million request-per-second DDoS attack which "the company says was the largest HTTP DDoS attack on record." Free services In 2014, Cloudflare began providing free DDoS mitigation for artists, activists, journalists, and human rights groups under the name "Project Galileo." More than 1,000 users and organizations were participating in Project Galileo as of 2020. In 2017, they extended the service to electoral infrastructure and political campaigns under the name "Athenian Project." In December 2020, Cloudflare released a beta Jamstack platform for front-end developers to deploy websites on Cloudflare's infrastructure, under the name "Pages." In January 2021, the company began providing its "Waiting Room" digital queue product for free for COVID-19 vaccination scheduling under the title "Project Fair Shot." Project Fair Shot later won a Webby People's Choice Award in 2022 for Event Management under the Apps & Software category. Security and privacy issues Intrusions On June 1, 2012, the hacker group UGNazi redirected visitors to the website 4chan to a Twitter account belonging to UGNazi by “hijacking” 4chan’s domain via Cloudflare. After initiating a password recovery for the Google Workspace hosted email account of Cloudflare CEO Matthew Prince, UGNazi then allegedly used social engineering to trick AT&T support staff into giving them access to his voicemail. Exploiting a bug in Google App’s two-factor authentication security procedures, the hackers allegedly used the voicemail-recovered password to access Prince’s email account without a second layer of authentication. Once in control of Prince’s email account, they were able to redirect the 4chan domain through Cloudflare’s database. Data leaks From September 2016 until February 2017, a major Cloudflare bug (nicknamed Cloudbleed) leaked sensitive data, including passwords and authentication tokens, from customer websites by sending extra data in response to web requests. The leaks resulted from a buffer overflow which occurred, according to numbers provided by Cloudflare at the time, more than 18,000,000 times before the problem was corrected. In May 2017, ProPublica reported that Cloudflare routinely discloses the names and email addresses of persons complaining about hate sites to the operators of those sites, which has led to the complainants being harassed. Cloudflare's general counsel defended the company's policies by saying it is "base constitutional law that people can face their accusers", and noted that there had been a disclaimer on Cloudflare's complaint form since 2015 stating that they "would notify the site owner." Cloudflare's CEO later suggested that, had people