How big will this Drift get? Cloudflare cops to Salesloft Drift breach

The list of victims keeps growing, as yet another company — Cloudflare — today disclosed that some of its customers' data was also compromised in the Salesloft Drift breach. In a very comprehensive post mortem published Tuesday, Cloudflare's Head of Security Response Sourov Zaman, Senior Director of Threat Detection and Response Craig Strubhart, and Chief Information Security Officer Grant Bourzikas detailed the Drift attack, which affected Salesforce databases. Drift is a third-party app that integrates with Salesforce databases to help manage leads. "Because of this breach, someone outside Cloudflare got access to our Salesforce instance, which we use for customer support and internal customer case management, and some of the data it contains," the Cloudflare trio wrote. "Most of this information is customer contact information and basic support case data, but some customer support interactions may reveal information about a customer's configuration and could contain sensitive information like access tokens," they continued. "Given that Salesforce support case data contains the contents of support tickets with Cloudflare, any information that a customer may have shared with Cloudflare in our support system — including logs, tokens or passwords — should be considered compromised, and we strongly urge you to rotate any credentials that you may have shared with us through this channel." Cloudflare also pinned the blame on a threat group it tracks as GRUB1, which the security e...