Cloudflare is the most recent firm impacted in a current string of Salesloft Drift breaches, a part of a supply-chain assault disclosed final week.
The web big revealed on Tuesday that the attackers gained entry to a Salesforce occasion it makes use of for inside buyer case administration and buyer assist, which contained 104 Cloudflare API tokens.
Cloudflare was notified of the breach on August 23, and it alerted impacted clients of the incident on September 2. Earlier than informing clients of the assault, it additionally rotated all 104 Cloudflare platform-issued tokens exfiltrated in the course of the breach, despite the fact that it has but to find any suspicious exercise linked to those tokens.
“Most of this data is buyer contact data and primary assist case knowledge, however some buyer assist interactions could reveal details about a buyer’s configuration and will include delicate data like entry tokens,” Cloudflare stated.
“Provided that Salesforce assist case knowledge incorporates the contents of assist tickets with Cloudflare, any data {that a} buyer could have shared with Cloudflare in our assist system—together with logs, tokens or passwords—needs to be thought-about compromised, and we strongly urge you to rotate any credentials that you could have shared with us by way of this channel.”
The corporate’s investigation discovered that the menace actors stole solely the textual content contained throughout the Salesforce case objects (together with buyer assist tickets and their related knowledge, however no attachments) between August 12 and August 17, after an preliminary reconnaissance stage on August 9.
These exfiltrated case objects contained solely text-based knowledge, together with:
- The topic line of the Salesforce case
- The physique of the case (which can embody keys, secrets and techniques, and many others., if offered by the client to Cloudflare)
- Buyer contact data (for instance, firm identify, requester’s electronic mail handle and telephone quantity, firm area identify, and firm nation)
“We consider this incident was not an remoted occasion however that the menace actor meant to reap credentials and buyer data for future assaults,” Cloudflare added.
“Provided that lots of of organizations have been affected by way of this Drift compromise, we suspect the menace actor will use this data to launch focused assaults in opposition to clients throughout the affected organizations.”
Wave of Salesforce data breaches
For the reason that begin of the 12 months, the ShinyHunters extortion group has been focusing on Salesforce clients in knowledge theft assaults, utilizing voice phishing (vishing) to trick staff into linking malicious OAuth apps with their firm’s Salesforce cases. This tactic enabled the attackers to steal databases, which have been later used to extort victims.
Since Google first wrote about these assaults in June, quite a few data breaches have been linked to ShinyHunters’ social engineering ways, together with these focusing on Google itself, Cisco, Qantas, Allianz Life, Farmers Insurance coverage, Workday, Adidas, in addition to LVMH subsidiaries Louis Vuitton, Dior, and Tiffany & Co.
Whereas some security researchers have informed BleepingComputer that the Salesloft provide chain assaults contain the identical menace actors, Google has discovered no conclusive proof linking them.
Palo Alto Networks additionally confirmed over the weekend that the menace actors behind the Salesloft Drift breaches stole some assist knowledge submitted by clients, together with contact data and textual content feedback.
The Palo Alto Networks incident was additionally restricted to its Salesforce CRM and, as the corporate informed BleepingComputer, it didn’t have an effect on any of its merchandise, programs, or providers.
The cybersecurity firm noticed the attackers looking for secrets and techniques, together with AWS entry keys (AKIA), VPN and SSO login strings, Snowflake tokens, in addition to generic key phrases corresponding to “secret,” “password,” or “key,” which might be used to breach extra cloud platforms to steal knowledge in different extortion assaults.
46% of environments had passwords cracked, practically doubling from 25% final 12 months.
Get the Picus Blue Report 2025 now for a complete have a look at extra findings on prevention, detection, and knowledge exfiltration developments.
