Loading story…
Salesforce is under intense scrutiny following a series of cyberattacks that led to the exposure of customer data through a third-party application, Salesloft, which utilized OAuth tokens. Multiple lawsuits, including several seeking class action status, have been filed in Northern California against Salesforce and its users, alleging that the company failed to implement adequate cybersecurity measures to protect personally identifiable information (PII). Plaintiffs claim that the breach has resulted in victims being at heightened risk for identity theft and fraud, with some already experiencing concrete injuries. The lawsuits demand that Salesforce disclose the full extent of the compromised information and adopt stronger security practices to prevent future incidents. Salesforce has publicly denied that its own systems were compromised, asserting that the breaches were not due to shortcomings in its platform. However, the attacks were confirmed by Google Threat Intelligence Group, which identified the theft of OAuth tokens from the Salesloft Drift app as the attack vector. The FBI has issued warnings about the increasing trend of compromised accounts, highlighting the broader risk to cloud platforms like Salesforce. Security experts from AppOmni, Google Cloud Mandiant, and Okta have weighed in, noting that while Okta's brand was misused in some attack variants, its platform was not directly affected. The breaches have led to significant reputational damage for Salesforce, with many organizations—some of them major brands—reporting large-scale data exfiltration and subsequent ransom demands. Some affected companies have been transparent about their use of Salesforce as the attack target, while others have referred more vaguely to third-party applications. Media reports have widely suggested that Salesforce was the underlying system in many of these incidents. The lawsuits allege that Salesforce's trust-first culture has been undermined by these events, and that the company could have done more to secure the exploited parts of its platform. Victims are now advised to monitor their financial accounts and credit reports closely. The legal actions seek both compensation for damages and injunctive relief to force improvements in Salesforce's security posture. The ongoing litigation and public scrutiny have created a trust crisis for Salesforce, as customers and regulators demand greater transparency and accountability. The incident underscores the risks associated with third-party integrations and the importance of robust OAuth token management. Salesforce's response and the outcomes of these lawsuits are likely to have significant implications for the broader SaaS and cloud services industry.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
By September 26, reports said Salesforce was facing multiple lawsuits in connection with the Salesloft breach. This represented a further escalation from an earlier potential class action to several active legal claims.
Reporting said Salesforce was facing a potential class action lawsuit tied to the cyberattack fallout and customer trust concerns. This marked the first referenced legal escalation in the story.
A breach involving Salesloft led to broader scrutiny of Salesforce's security posture, with reporting describing Salesforce as facing a growing trust problem after cyberattack-related fallout. The incident appears to be the underlying event driving subsequent legal action.
Google Threat Intelligence Group published research describing UNC6395 as conducting a widespread data theft campaign against Salesforce customer instances using compromised OAuth tokens tied to the Salesloft Drift platform. The report said the actor exported Salesforce data, searched it for secrets such as AWS keys and passwords, and warned Drift-integrated organizations to investigate exposure and rotate any exposed credentials.
4 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcetheregister.com
Open sourcezdnet.com
Open sourceaustinlarsen.me
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A significant wave of OAuth-related breaches has recently impacted the Salesforce ecosystem, resulting in the exposure of sensitive data from over 700 organizations and affecting nearly 1.5 billion records. The breaches were not due to a direct compromise of Salesforce itself, but rather stemmed from attackers exploiting weaknesses in third-party OAuth integrations connected to Salesforce environments. At the recent Dreamforce conference, Salesforce emphasized security as a shared responsibility and introduced new AI-driven security and compliance agents, but notably did not address the recent OAuth breach incidents that have led to more than 70 lawsuits. Security experts highlighted this omission, noting that the lessons from these breaches are critical for the future of interconnected, AI-driven business platforms. According to Google Threat Intelligence Group, the attackers systematically exported large volumes of data from numerous corporate Salesforce instances by abusing OAuth tokens. These tokens, which are designed to allow secure, delegated access to cloud applications, were leveraged by threat actors to gain persistent, high-privilege access to customer data. Proofpoint researchers have further warned that attackers are increasingly abusing both external and internal OAuth-based applications to maintain access to cloud environments, even after password resets or the enforcement of multifactor authentication. Internal OAuth applications, which are registered within an organization’s own cloud tenant and typically trusted, can be particularly difficult to detect when compromised. Attackers have developed automated toolkits to register malicious OAuth applications with pre-configured permissions, using compromised admin accounts to escalate privileges and maintain persistence. The breaches underscore the risks inherent in SaaS supply chains, where third-party integrations can become a vector for large-scale data exfiltration. Security professionals stress the importance of monitoring OAuth app permissions, regularly auditing third-party integrations, and educating users about the risks of granting excessive access. The incident has prompted calls for greater transparency and proactive security measures from both SaaS providers and their customers. The scale of the breach and the sophistication of the attack methods highlight the evolving threat landscape facing cloud-based business platforms. Organizations are urged to review their OAuth security posture and implement robust controls to mitigate similar risks in the future. The incident serves as a stark reminder that even trusted cloud environments can be compromised through indirect attack vectors, necessitating a holistic approach to cloud security.
Jun 29, 2026
A ransomware group known as Scattered Lapsus$ Hunters, also referred to as ShinyHunters, has launched a darkweb data-leak site to pressure victims of a significant Salesforce data breach into paying extortion demands. The group claims to have stolen 1.5 billion Salesforce records from 760 companies that integrated their Salesforce customer relationship management (CRM) software with the Salesloft Drift artificial intelligence chatbot. The leak site, which debuted on a Friday, lists 39 victim organizations, including major brands such as Cisco, Disney, KFC, Ikea, Marriott, McDonald's, Walgreens, Albertsons, and Saks Fifth Avenue. The attackers are demanding separate ransoms from Salesforce itself to prevent the release of data pertaining to the remaining 721 affected companies. Samples of the stolen data published by the group include extensive personally identifiable information (PII), such as names, dates of birth, nationalities, passport numbers, full contact information, and employment histories. Cybersecurity researcher Milivoj Rajić has tested multiple samples of the leaked data and confirmed their validity, indicating the breach is authentic and the data is genuine. Additional compromised data includes shipping information, marketing lead data, customer support case records, chat transcripts, flight details, and car ownership records. The attack specifically targeted organizations that had integrated Salesforce with the Salesloft Drift AI chatbot, suggesting a possible exploitation of integration points or third-party application vulnerabilities. The public exposure of such a large volume of sensitive data significantly increases the risk of identity theft, fraud, and further targeted attacks against both individuals and organizations. The ransomware group’s strategy of publishing a leak site and naming high-profile victims is designed to maximize pressure and reputational damage, thereby increasing the likelihood of ransom payments. The incident highlights the risks associated with third-party integrations in cloud environments, especially when sensitive customer data is involved. Security teams at affected organizations are likely conducting forensic investigations, assessing the scope of the breach, and notifying impacted customers. The breach underscores the importance of robust access controls, regular security assessments of third-party integrations, and rapid incident response capabilities. Salesforce and Salesloft Drift users are advised to review their security configurations and monitor for suspicious activity. The event has drawn significant attention from the cybersecurity community due to the scale of the breach and the high-profile nature of the victims. Organizations are being urged to remain vigilant and to implement additional security measures to protect against similar attacks in the future.
Jun 29, 2026
A series of extortion attacks have targeted organizations using Salesforce, resulting in the leakage of millions of records. Attackers have exploited vulnerabilities or misconfigurations in Salesforce environments to gain unauthorized access to sensitive customer and business data. Once inside, the threat actors exfiltrated large volumes of information, which they then used as leverage in extortion attempts against the affected companies. The attackers threatened to publicly release or sell the stolen data unless their demands were met, putting significant pressure on the victim organizations. Security experts have highlighted that these incidents demonstrate the growing risk of supply chain and third-party platform attacks, as Salesforce is widely used across industries for customer relationship management. The attacks have raised concerns about the adequacy of security controls and monitoring within cloud-based SaaS platforms, especially when organizations rely heavily on default configurations. In response, security professionals have urged companies to review their Salesforce security settings, implement robust access controls, and monitor for unusual activity. The incidents have also prompted calls for better incident response planning, as organizations must be prepared to act quickly in the event of a breach involving critical business platforms. The extortion group responsible for these attacks has demonstrated technical sophistication, leveraging both technical exploits and social engineering tactics to maximize their impact. The exposure of millions of records has potential regulatory and reputational consequences for the affected organizations, particularly in jurisdictions with strict data protection laws. Security podcasts and news outlets have discussed the technical details of the attacks, the methods used by the extortionists, and the broader implications for cloud security. Experts have also noted that these attacks may inspire copycat incidents targeting other SaaS providers. The events underscore the importance of regular security assessments and employee training to defend against evolving threats. Organizations are advised to stay informed about emerging attack techniques and to collaborate with their SaaS vendors to ensure comprehensive security coverage. The Salesforce extortion attacks serve as a stark reminder of the risks associated with cloud service dependencies and the need for proactive cybersecurity measures.
Jun 29, 2026