EXPLORINEER
en

Archive — US — techcrunch

Salesloft says Drift customer data thefts linked to March GitHub account hack

Salesloft reports that a March breach of its GitHub account by hackers led to the theft of authentication tokens, impacting several major customers of Drift, including Google and Cloudflare. The hackers exploited the stolen tokens to access sensitive data. The breach lasted from March to June before being detected, raising concerns about Salesloft’s security defenses. The incident has been contained, and integration with Salesforce has been restored.

Key points

  • In March, hackers breached Salesloft's GitHub account, stealing authentication tokens.
  • These tokens were used to hack Drift, a customer of Salesloft, affecting companies like Google, Cloudflare, and Palo Alto Networks.
  • The breach involved reconnaissance activities from March to June before detection.
  • Questions are raised about Salesloft’s security measures following the incident’s six-month duration.
  • The hacking group UNC6395, identified by Google’s Threat Intelligence Group, is linked to the breach.
  • The hackers targeted sensitive AWS credentials, Salesforce data, and OAuth tokens.
  • Salesloft states that the incident is contained, and integration with Salesforce is restored.

Why it matters

  • Cybersecurity breaches have become increasingly common, highlighting vulnerabilities in tech infrastructure.
  • The incident is relevant to ongoing discussions about the security of cloud services and third-party integrations.
  • Refers to trends in IT security where supply chain attacks have become a major concern for organizations.
  • As companies increasingly rely on cloud-based platforms, ensuring robust security measures is crucial.
  • The situation emphasizes the need for enhanced detection and monitoring practices in cybersecurity.

The Salesloft breach serves as a critical reminder of the vulnerabilities in tech security, particularly concerning third-party integrations; it illustrates that companies must prioritize robust security measures and rapid vulnerability detection to protect sensitive customer data.