Security Advisory
BGP.Exchange security incident
BGP.Exchange, a third-party internet exchange where BERIFFANET (AS219271) maintained route-server peering, has disclosed a security incident. As a precaution, Beriffa has suspended all BGP.Exchange connectivity. No Beriffa customer data is affected.
What happened
BGP.Exchange reports that an unauthorized party accessed its infrastructure between roughly 05:00 Saturday 12 September and 05:00 Sunday 13 September 2026 (AEST). According to BGP.Exchange, the intruder reached internal systems and hypervisors, defaced its website, accessed its management platform, and used its mail systems to send unauthorized emails to members. BGP.Exchange states that member-data exfiltration has not been confirmed, and that the member information involved (autonomous system numbers and peering details) is already publicly available.
How this affects Beriffa
BERIFFANET peered with other networks over the BGP.Exchange route-server fabric. Because that fabric is operated by BGP.Exchange, peering routes that transited it are temporarily unavailable while sessions are suspended. Traffic continues to flow over our other internet exchanges and transit providers, so services remain available; you may simply see routing take alternate paths.
Your data is safe
No Beriffa customer data is stored on, or reachable through, BGP.Exchange. The only information ever shared with the exchange was public network data - our ASN and peering addresses. Customer accounts and the control panel run on Cloudflare, and hosted services on Beriffa's own network; none of them was part of this incident.
No active connectivity to BGP.Exchange
As soon as we learned of the incident we suspended every BGP.Exchange route-server session. There is currently no live connectivity between BERIFFANET and BGP.Exchange. We will restore peering only once BGP.Exchange confirms its systems are fully secured and independently verified.
What you should do
- Disregard any unexpected email that appears to come from BGP.Exchange - those messages are part of the incident, not legitimate communications.
- No action is needed on your Beriffa account; no Beriffa credentials were exposed.
- If you peer with us directly and have questions about affected routes, contact our NOC.
Timeline
- 12 Sep 2026BGP.Exchange incident window begins (per BGP.Exchange, from ~05:00 AEST).
- 13 Sep 2026BGP.Exchange discloses the incident; Beriffa suspends all BGP.Exchange route-server sessions.
- OngoingBeriffa monitors the investigation; connectivity stays suspended until BGP.Exchange is verified secure.
Official source
For BGP.Exchange's own statement and latest updates, see their incident notice:
bgpexchange.comEverything else is running normally
Your services, data, and account are unaffected. Reach out to our NOC if you need anything.