Cloudflare hit by data breach in Salesloft Drift supply chain attack

Cloudflare has been affected by a data breach in the Salesloft Drift supply chain attack, with attackers gaining access to a Salesforce instance used for internal customer case management that contained 104 Cloudflare API tokens. Cloudflare was notified of the breach on 23 August and began alerting impacted customers on 2 September, after which it rotated all 104 tokens exfiltrated during the breach, while finding no suspicious activity linked to them.

According to Cloudflare, most of the information involved is customer contact information and basic support data, but some interactions may reveal details about a customer’s configuration and could contain sensitive data like access tokens. The company said the incident appears to be part of an ongoing effort to harvest credentials and customer information for future attacks, with hundreds of organisations affected through this Drift compromise.

Investigators found that the threat actors exfiltrated only text contained within Salesforce case objects between 12 August and 17 August, including the subject line, the body of the case (which may include keys or secrets if provided), and customer contact details.