Salesloft says Drift customer data thefts linked to March GitHub account hack

Celslaft said that in March, the hackers were allowed to steal the hackers’ authentication tokens as a result of the violation of his Github account, which was later used to target a number of large technology customers.

Google’s Events Response Unit Salesloft says quoting Mandents’ investigation Its data breach of data The ages who have also accessed the Githab account in Salesloft and performed the revision activities from March to June, which “allows them to download content from multiple storage, add a guest user and establish work flow.”

The timeline raises new questions about the company’s security posture, including why it took about six months to identify the infiltration of the sales loft.

Sellaft said that the event is now “included.”

After the hackers entered his Githab account, the company said that hackers have accessed the Amazon Web Services Cloud Environment of the Chatbot-Purchase Marketed Marketing Platform Drift, which allows them to steal Oth Token for their drift customers. OAuth A value that allows users to allow an application or service to connect with another. Depending on Oouth, the drift website can integrate with the audience to interact with the salesforce and the platforms like others.

While stealing these tokens, threatened actors violated several cellloft customers such as Bugcode, Cloudflair, Google, Proofpoint, Palo Alto Networks and Tenable, In othersMany of which are probably still unknown.

Google Reveal the supply chain violation In late August, it blames a hacking group it is called UNC 6395.

Cyber ​​Security Publications Databrich.net And Blipping computer It was previously reported that hackers behind the violation are the hacking group known as Shinhunters. The hackers are believed to be trying to extortion by personally contacting the victims.

By accessing the saleslaft tokens, hackers then access the selling -centric examples, where they steal sensitive data they have supported tickets. Sellaft “” The initial purpose of the actor was to steal the credentials, especially on AWS Access Key, Password and Focus on sensitive information like Snowflake related access tokens, ” D August 26.

Sales D Its integration with the salesforce on Sunday is now restored.