The data breaches that have been disclosed so far have raised concerns about social engineering attacks that could be strengthened by the data that was stolen, Dark Reading reported Thursday (Sept. 4).
Salesloft disclosed last month that a fraudster breached Drift, the company’s marketing software-as-a-service product, by stealing OAuth and refresh tokens from its Salesforce integration and then used the tokens to move into some Salesloft customer environments and steal data, according to the report.
Several companies have disclosed data breaches that resulted from this attack, the report said. They include Zscaler, Palo Alto Networks, Proofpoint, Cloudflare and Tenable.
The disclosures show that the data that was stolen includes business contact information and support case content, per the report. The information is not as sensitive as information taken in other cyber incidents, but it could be used for social engineering attacks.
However, because other types of data can be stored in Salesforce instances, the severity of the attack has not yet been determined, the report said.
Advertisement: Scroll to Continue
When Cloudflare announced that it had been impacted by the data breach, it said: “Most of this information is customer contact information and basic support case data, but some customer support interactions may reveal information about a customer’s configuration and could contain sensitive information like access tokens.”
The Thursday report by Dark Reading highlighted a blog post from Okta that said Okta was targeted in the attack but prevented a breach of its Salesforce instance.
“Our security team thoroughly investigated our systems and confirmed that while we observed evidence of attempts to access our resources using stolen tokens, our defenses worked as designed to prevent a breach,” the post said.
In a Wednesday (Sept. 3) update posted on its website, Salesloft said it recommends that “all third-party applications integrated with Drift via API key proactively revoke the existing key for these applications.”
The company also shared a link to a blog post from Mandiant that includes detailed recommendations for impacted organizations.
