Cloudflare says attackers accessed a Salesforce instance it uses for internal customer case management and customer support, the latest Salesloft Drift breach
Cloudflare is the latest company impacted in a recent string of Salesloft Drift breaches, part of a supply-chain attack disclosed last week.
Context & Ripple Effects
Cloudflare’s disclosure extends a campaign that began with stolen OAuth tokens tied to Salesloft’s Drift integration, which attackers used to reach Salesforce data. The affected Cloudflare environment handled internal customer cases and support, making a third-party integration a route into sensitive operational records.
It also follows Cloudflare’s earlier incident involving tokens stolen in Okta’s breach, reinforcing how identity and access artifacts can carry compromise across company boundaries. Subsequent reporting has framed the Drift incident as part of a broader Salesforce-focused supply-chain exposure.
First-order effects
- Cloudflare must assess what information in its internal Salesforce case-management and support instance was accessible through the compromised path, and contain the affected integration.
- Salesloft Drift customers using Salesforce OAuth connections face an immediate need to review and revoke or rotate exposed access paths, consistent with the token-theft mechanism previously disclosed.
Second-order effects
- Salesforce customers and their security teams are pushed to inventory third-party applications with broad CRM permissions, rather than treating Salesforce access as an isolated platform-control issue.
- Salesloft and comparable support or chat-integration vendors face greater pressure to demonstrate token protection, least-privilege authorization, and rapid customer-facing incident controls.
Third-order effects
- The incident points to a growing supply-chain identity risk: a compromise at an application integration can expose many customers’ cloud data without directly breaching each customer’s core infrastructure.
- If this pattern persists, enterprise security programs will increasingly govern OAuth scopes, token lifecycles, and vendor-connected applications as a distinct attack path into SaaS data, alongside traditional endpoint and network controls.
The trend: Enterprise SaaS security is shifting toward tighter control of third-party OAuth integrations as shared application ecosystems become a scalable route to customer data.