August 2025: SaaS Supply Chain Breaches, Telecom Data Exposures, and Ransomware Campaigns

August 2025 saw a surge of high‑impact cyber incidents, with SaaS supply chain and data‑exposure events dominating headlines. The Salesloft Drift integration breach exposed over 700 organisations after threat actors used stolen OAuth tokens to access multiple services, with Salesloft revoking tokens on August 20 and restoring Salesforce sync under tighter controls.

A joint NSA/NCSC attribution linked Salt Typhoon to Chinese technology firms, highlighting state‑linked activity targeting government, military, and telecom networks since at least 2021 and exploiting various edge‑device flaws. Colt Technology Services disclosed data theft after a Warlock ransomware attack, with the attackers allegedly auctioning what they claim to be one million Colt documents.

Bouygues Telecom reported that 6.4 million customers’ data were affected, including IBANs, while TransUnion disclosed a breach impacting more than 4.4 million consumers tied to a third‑party application. Salesforce breaches affected over 90 organisations across sectors, with attackers tracked as UNC6040 using social engineering and OAuth abuse.

Other notable incidents included DaVita’s 2.7 million patient data exposure and Akira campaigns exploiting CVE-2024-40766 in SonicWall SSLVPN, underscoring ongoing risks from unpatched or misconfigured systems.