Cloudflare: Attackers stole OAuth tokens, accessed Salesforce cases

Cloudflare said Tuesday that attackers gained access to customer support data in its Salesforce instance after exploiting stolen OAuth tokens tied to the Salesloft Drift chatbot, part of a wider campaign that affected hundreds of organizations in early to mid August. Cloudflare reported initial reconnaissance on August 9 and said the intruders accessed and exfiltrated Salesforce case objects between August 12 and 17, but its core systems and infrastructure were not compromised.

According to Cloudflare, the exposed data consisted primarily of Salesforce case objects used for support tickets, including customer contact information, case subject lines and the body of case correspondence. The company said attachments were not accessed, but warned that some text fields in support tickets contained logs, configuration details and in some instances tokens or credentials that customers had pasted during troubleshooting. Cloudflare identified 104 valid API tokens in the stolen dataset, rotated those tokens and reported no linked suspicious activity to date. Customers potentially affected were notified directly by email and by banner notices in Cloudflare’s dashboard.