Cloudflare disclosed that its Salesforce instance was compromised due to the Salesloft Drift breach.
A sophisticated actor, dubbed GRUB1, exploited OAuth credentials from Salesloft’s Drift integration to exfiltrate text-based support case data.
While no core Cloudflare services were impacted, sensitive customer contact details, support ticket contents, and potentially embedded tokens were exposed—prompting urgent credential rotations and customer notifications.
Scope and Technical Details of the Breach
According to the report, the incident originated when Salesloft’s systems were breached, allowing GRUB1 to harvest OAuth tokens linked to the Drift chatbot integration.
Between August 12 and August 17, 2025, GRUB1 performed reconnaissance and data exfiltration via Salesforce’s REST and Bulk API 2.0 endpoints.
Key technical actions included:
| Date (UTC) | Action |
|---|---|
| 2025-08-12 22:14:08 | GET /services/data/v58.0/sobjects/ — Enumerated all Salesforce objects using stolen OAuth credentials. |
| 2025-08-13 19:33:11 | SOQL Query — Retrieved Case object fields in a broad query to map support case schema. |
| 2025-08-17 11:11:56 | Bulk API 2.0 Job — Exfiltrated all Case object records (text fields only). |
| 2025-08-17 11:15:42 | DELETE Bulk API Job — Attempted log cleanup; residual logs enabled forensic reconstruction. |
GRUB1’s tooling included TruffleHog-based User-Agents and Python’s aiohttp for parallel API calls.
All discovered Cloudflare API tokens (104 in total) were rotated, and no suspicious activity was found post-rotation.
Impact on Cloudflare and Customers
Although infrastructure remained intact, the breach undermined trust in third-party integrations:
- Customer Data Exposure: Email addresses, phone numbers, case subject lines, and freeform text fields—where customers sometimes pasted access tokens—are now compromised.
- Operational Response: Cloudflare disabled the compromised Drift integration, revoked all affected secrets, and enforced weekly secret rotation across its third-party ecosystem.
- Customer Guidance: Impacted customers received direct notifications and in-dashboard banners advising immediate rotation of any credentials shared via support cases.
The breach highlights the need for stringent controls around OAuth scopes, least-privilege access, and continuous monitoring of integrated SaaS applications.
Cloudflare’s recommendations include:
- Disconnect Salesloft/Drift from Salesforce and rotate all integration credentials.
- Implement automated secret scanning (using regex and entropy-based detection) in support case data.
- Enforce IP-restricted and time-bound OAuth tokens to limit blast radius.
- Audit third-party apps for role-based access control (RBAC) compliance.
Cloudflare’s in-house threat intelligence team, Cloudforce One, continues to analyze GRUB1’s tactics and will publish detailed tradecraft insights.
This incident underscores the interconnected risks of modern SaaS integrations and the necessity for organizations to adopt proactive security measures—particularly around API governance and SaaS supply-chain resilience.
By sharing these findings, Cloudflare aims to bolster defenses across the industry and prevent similar attacks on customer support platforms.
Find this Story Interesting! Follow us on Google News , LinkedIn and X to Get More Instant Updates
%20(1).webp?fit=1600,900&ssl=1&description=A sophisticated adversary, dubbed GRUB1, exploited OAuth credentials from Salesloft’s Drift integration to exfiltrate text-based support case data.){kind=link}