Cloudflare Confirms Supply Chain Attack, Customer Support Data Exposed

According to Cloudflare, the data exposure affected customer support submissions filed between 12 August 2025 and 17 August 2025, with any content within those tickets—including descriptions, attached logs, passwords, tokens, or other sensitive credentials—potentially accessed by attackers. Cloudflare has begun notifying affected customers and is urging immediate password resets and token rotations. The company confirmed that stolen tokens were discovered, prompting the rotation of 104 Cloudflare API tokens.

In its explanation, Cloudflare detailed that Salesforce CRM serves as the backbone for tracking customers and managing support workflows, while Salesloft Drift provides a real-time communication platform for website visitors, noting that breaches arose from third‑party intrusions in this supply chain.

It emphasised that Salesforce CRM itself was not directly compromised, and that the breaches largely stemmed from either phishing affecting employees of affected clients or supply chain intrusions involving third-party services like Salesloft. Cloudflare has recommended that users disconnect Salesloft from their Salesforce environments, uninstall related applications or extensions, and replace third‑party credentials tied to Salesforce CRM instances to prevent continued unauthorized access.