⚡ MiltonMarketing.com Powered by Rocket.net – Managed WordPress Hosting
Approx. read time: 7.7 min.
Post: Cloudflare Salesforce Breach: 5 Key Lessons from the Salesloft Drift Supply Chain Attack
Introduction – Cloudflare Salesforce breach
In late August 2025, Cloudflare sent out urgent notifications to its customers after discovering that a third-party supply chain compromise had exposed data from its Salesforce support system. The breach originated not inside Cloudflare’s core infrastructure, but through Salesloft Drift, a customer support chatbot that integrates with Salesforce.
From August 12 to August 17, 2025, attackers used stolen OAuth tokens to infiltrate Salesforce tenants of multiple companies, including Cloudflare, Zscaler, Palo Alto Networks, Proofpoint, and others. Although Cloudflare’s services and infrastructure remained unaffected, customer support case data—including contact details and case messages—was exposed.
This incident underscores a troubling reality: the weakest link in modern cybersecurity is often not your own system, but the third-party integrations you rely on. In this article, we’ll break down the details of the Cloudflare Salesforce breach, explore why OAuth tokens are such high-value targets, analyze similar SaaS breaches like Okta and MOVEit, and explain why businesses must rethink their approach to third-party risk.
Timeline of the Cloudflare Salesforce Breach – Salesloft Drift breach
According to Cloudflare’s official incident blog, the attack unfolded as follows:
-
August 9, 2025 → Reconnaissance activity detected, as attackers tested Cloudflare-related tokens in Salesforce.
-
August 12–17, 2025 → Attackers successfully accessed Salesforce support case data using compromised OAuth tokens from Drift.
-
August 23, 2025 → Cloudflare was notified of suspicious activity and immediately disabled the Drift integration.
-
Post-August 23 → Cloudflare rotated more than 100 internal API tokens, reviewed access logs, and began notifying customers.
The exposed data included customer contact information and support case text fields. Importantly, file attachments were not accessed, and no evidence suggests Cloudflare infrastructure or core services were impacted.
What Data Was Exposed? – Cloudflare Salesforce breach
Cloudflare emphasized that support case messages and customer contact details were exposed. While Cloudflare does not request sensitive data like API keys or credentials in support tickets, some customers may have included such information voluntarily in the text fields.
Exposed fields included:
-
Contact names and emails.
-
Case subject lines.
-
Case message bodies.
Attachments (such as screenshots, logs, or config files) were not compromised.
Cloudflare’s Response – Cloudflare Salesforce breach
Cloudflare’s remediation efforts were swift and comprehensive:
-
Disabled all Drift connections to Salesforce immediately.
-
Rotated 104 internal API tokens that were referenced in support cases.
-
Conducted full forensic reviews of Salesforce activity logs.
-
Expanded the response to include cross-functional teams spanning security, legal, and communications.
-
Issued customer advisories recommending token rotation and review of their own support case data.
Cloudflare stressed that no malicious activity has been observed against rotated tokens since the attack.
The Bigger Picture: Industry-Wide Impact – Salesloft Drift breach
Cloudflare was not alone. This was a mass supply-chain compromise that affected at least 700 organizations. Victims included:
-
Zscaler
-
Palo Alto Networks
-
Proofpoint
-
Rubrik
-
Select Google Workspace accounts tied to Drift integrations
Google confirmed that while some Workspace accounts were accessed, no core Google systems were affected, and Drift integrations have since been disabled.
The threat actor, tracked as UNC6395 (aka GRUB1), was highly skilled, employing tactics such as log manipulation and selective exfiltration to avoid detection.
Deep Dive: Why OAuth Tokens Are a Hacker’s Dream – Cloudflare Salesforce breach
At the heart of this breach lies a fundamental problem: OAuth tokens.
How OAuth Works
OAuth allows applications (like Drift) to access another platform (like Salesforce) without requiring a password. Instead, OAuth uses tokens that grant delegated permissions. This is what makes integrations seamless—your chatbot can fetch Salesforce data without constant re-authentication.
The Problem
If an attacker steals a token, they inherit all the permissions associated with it—no password, MFA, or login prompts required. In many cases:
-
Tokens have overly broad scopes, giving more access than needed.
-
Tokens are long-lived, with no enforced expiry.
-
Logs for token usage are less scrutinized than login attempts.
Why This Breach Was So Dangerous
Because Drift’s tokens granted access to Salesforce, the attacker could query entire case datasets without ever needing to compromise Cloudflare credentials directly. This meant:
-
MFA was bypassed.
-
SSO was irrelevant.
-
Traditional login alerts never fired.
Best Practices for Businesses
-
Rotate tokens regularly (every 30–60 days).
-
Apply least privilege—limit scopes to exact functions.
-
Monitor token activity in SIEM or Salesforce logs.
-
Revoke unused integrations proactively.
This breach shows that tokens are the new passwords, and they must be treated with equal security rigor.
Case Study: SaaS Supply-Chain Breaches Before Drift
The Drift compromise is not an isolated event—it’s part of a pattern of third-party integration failures that have rocked the industry.
Okta Support System Breach (2022–2023)
Okta, the identity provider giant, was breached multiple times through its customer support system. Attackers accessed support case attachments that contained sensitive HTTP archive files (HARs) with session tokens. This incident impacted customers like Cloudflare, BeyondTrust, and 1Password.
Lesson: Even identity platforms, which specialize in security, can be compromised if support workflows store sensitive data.
MOVEit Transfer Exploitation (2023)
The Cl0p ransomware gang exploited a zero-day in Progress Software’s MOVEit Transfer, a widely used file transfer tool. The attack hit thousands of organizations globally, including government agencies and Fortune 500 firms.
Lesson: One vulnerable vendor product can create a global supply-chain blast radius, even for companies with robust internal defenses.
GitHub / Heroku OAuth Token Theft (2022)
Attackers stole OAuth tokens issued to Heroku and Travis CI, then used them to download private GitHub repositories.
Lesson: OAuth tokens themselves are high-value assets, and securing them must be prioritized.
Why Third-Party Integrations Are the Weakest Link – Cloudflare Salesforce breach
The Cloudflare Salesforce breach demonstrates a reality every IT and security leader must face: you are only as secure as your least secure vendor.
1. Every Integration Expands the Attack Surface
Companies today use dozens—sometimes hundreds—of SaaS applications. Each one comes with its own permissions, tokens, and data pipelines. Drift was “just a chatbot,” yet it had tenant-level access to Salesforce.
2. Token Sprawl and Visibility Gaps
Most companies lack full visibility into how many OAuth tokens exist across their environment. Many are forgotten, never rotated, or granted far more access than necessary.
3. Traditional Security Tools Don’t Cover SaaS
Endpoint detection and firewalls don’t monitor Salesforce or Slack API tokens. This leaves a blind spot attackers can exploit.
4. Vendor Trust Assumptions
Customers assume vendors like Drift and Salesloft maintain strong security, but as this breach shows, even a small integration can become an entry point.
5. Business Consequences
Exposed case data can lead to:
-
Phishing campaigns using legitimate customer context.
-
Credential stuffing if secrets were included.
-
Reputation damage from customer distrust.
Did you know? Verizon’s 2025 DBIR found that 62% of breaches involve the supply chain—not direct attacks on core systems.
What Customers Should Do Now – Cloudflare Salesforce breach
Cloudflare has recommended the following actions for all impacted customers:
-
Review all Salesforce support cases to see what information may have been exposed.
-
Rotate any credentials shared in Cloudflare support cases.
-
Rotate credentials used in cases with any other vendors, due to the broad nature of this incident.
-
Revoke OAuth tokens tied to Drift and Salesloft.
-
Audit permissions for all third-party integrations across your SaaS stack.
-
Review incident reports from Drift, Salesloft, and Salesforce.
Lessons Learned – Cloudflare Salesforce breach
-
Tokens = passwords. Treat them with the same security discipline.
-
Integrations expand risk. Even non-core tools can expose sensitive data.
-
Zero trust must extend to SaaS. Assume third-party vendors may be breached.
-
Customer behavior matters. Avoid sharing secrets in support tickets or email.
FAQs -Cloudflare Salesforce breach
Q1: What is the Cloudflare Salesforce breach?
It’s a data exposure caused by compromised OAuth tokens in the Salesloft Drift chatbot, which allowed attackers to access Salesforce support case data.
Q2: What data was compromised?
Customer contact information, support case subject lines, and case text fields. Attachments were not affected.
Q3: Was Cloudflare’s infrastructure breached?
No. Cloudflare services, products, and infrastructure were not impacted. Only Salesforce case data tied to Drift integration was exposed.
Q4: Who else was affected by the Drift attack?
At least 700 companies, including Zscaler, Palo Alto Networks, Proofpoint, Rubrik, and some Google Workspace accounts.
Q5: What should Cloudflare customers do?
Rotate credentials shared in support cases, revoke OAuth tokens, audit third-party integrations, and review Salesforce case content.
Q6: How can companies protect against similar breaches?
Limit OAuth token scopes, rotate tokens often, monitor API activity, and apply zero-trust principles to SaaS vendors.
Conclusion – Cloudflare Salesforce breach
The Cloudflare Salesforce breach via the Salesloft Drift integration is a wake-up call for every business that relies on third-party SaaS tools. While Cloudflare’s infrastructure remained untouched, customer data was exposed because of a trusted vendor integration gone wrong.
As the digital supply chain becomes increasingly complex, companies must recognize that security is only as strong as the weakest integration. By rotating tokens, auditing third-party permissions, and applying zero-trust principles to SaaS, organizations can reduce the risk of becoming collateral damage in the next supply-chain attack.
👉 Want to harden your WordPress and SaaS integrations? Contact Us
Related Posts
About the Author: Bernard Aybout (Virii8)
