Cloudflare Confirms Data Breach – Customer Data Exposed via Salesforce Attack

Cloudflare has disclosed a significant data breach affecting customer information following a supply chain compromise aimed at its Salesforce integration with Salesloft Drift, with the incident occurring between 12 and 17 August 2025. According to Cloudflare, the attack was conducted by an advanced threat actor designated as GRUB1, who exploited compromised OAuth credentials from the Salesloft Drift chatbot integration to access the company’s customer support system.

The exposed data includes customer contact information, support case subject lines, and the full body of customer correspondence with Cloudflare support, and could include any sensitive information customers shared in tickets, such as API tokens, passwords, logs and configuration details. The firm found 104 of its API tokens within the compromised data, though no suspicious activity related to these tokens was detected, and all were rotated as a precaution.

Cloudflare emphasised that none of its core services or infrastructure were compromised, and it notified customers on 23 August 2025, activating a four‑workstream incident response. Google’s Threat Intelligence Group has published research aligning with Cloudflare’s findings about this campaign.