SpyCloud confirms data exposure in Salesloft Drift supply chain attack
Learn More
SpyCloud, an identity threat protection company, is reporting that customer relationship management data was potentially compromised as part of the widespread Salesloft Drift security incident.
The incident was caused by hackers who targeted Salesforce customer instances through compromised OAuth authentication tokens associated with the Salesloft Drift application. SpyCloud was previously a customer of Salesloft and Drift.
The compromised tokens allowed unauthorized access to Salesforce instances of organizations that had integrated Drift with their Salesforce systems. Exposed data includes:
- Standard customer relationship management fields in Salesforce
- Data relating to customer relationships with SpyCloud
- Business contact information and relationship details
- Customer communication and interaction records
The number of affected SpyCloud customers or individuals has not been disclosed.
SpyCloud terminated token access and reviewed all systems and cloud-based tools for any aspects of Salesloft or Drift applications or integrations, deactivating all such integrations.
The company claims that consumer data is not believed to have been accessed, and their core darknet monitoring and identity protection services are not affected by the incident.
SpyCloud has advised customers to be careful with unusual communications, especially emails requesting passwords or related to payment terms. Customers who have concerns about communications claiming to be from SpyCloud, should contact security@spycloud.com or their designated customer success managers through verified channels.
