Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Cloudflare said attackers accessed its Salesforce tenant from August 12 through August 17, 2025, using credentials tied to the compromised Salesloft Drift–Salesforce integration. The attackers extracted text from Salesforce Case records, which contained customer-support tickets and contact information. Cloudflare said attachments were not accessed and that its production services and infrastructure were not compromised.
The risk is that support tickets can contain sensitive troubleshooting details, API tokens, passwords, logs, or configuration data. Cloudflare found 104 of its own API tokens in the affected data and rotated them, but each customer must review its own support history and rotate any exposed credentials.
What Cloudflare confirmed
Cloudflare disclosed the incident on September 2, 2025. According to its incident report, an attacker used stolen OAuth credentials associated with Salesloft’s Drift product to access Cloudflare’s Salesforce tenant.
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Salesforce was used for customer support and case management. The attacker accessed Salesforce Case objects and later used Salesforce Bulk API 2.0 to extract case text. Cloudflare said the exposed information primarily consisted of customer contact details and support-case content.
#1 Best Overall
This was not a direct compromise of Cloudflare’s edge network. Cloudflare said its services and infrastructure were not compromised. However, saying simply that “Cloudflare was not hacked” would be misleading: an unauthorized party did access a Cloudflare-controlled Salesforce environment and customer-support data.
What data may have been exposed?
Cloudflare said the affected Case records could include:
- Customer and organization names
- Requestor email addresses and phone numbers
- Company domains and countries
- Support-case subjects
- Freeform correspondence between customers and support staff
- Configuration details and troubleshooting information
- Logs, API tokens, passwords, or other credentials pasted into tickets
Cloudflare said the exposure was limited to Salesforce Case-object text fields and that attachments and files were not accessed in its tenant. That does not mean every Cloudflare customer was affected or that every ticket contained secrets. It means customers should determine whether their own case text included information that now needs to be treated as exposed.
Recommended Free Tools
Was Cloudflare’s network compromised?
Cloudflare said there was no evidence that its production services or infrastructure were compromised. It also said it found 104 Cloudflare API tokens in the compromised case data, rotated all of them, and found no suspicious activity associated with those tokens.
That finding is reassuring but does not eliminate customer risk. The 104 tokens were Cloudflare’s tokens. Customers may have pasted their own Cloudflare tokens, cloud credentials, origin-server passwords, database credentials, or other secrets into separate support cases. Each organization must assess its own records.
How the Salesloft Drift attack worked
The attack illustrates a SaaS supply-chain compromise:
- Salesloft Drift was compromised.
- The attacker obtained OAuth credentials connected to Drift’s Salesforce integration.
- The credentials were used to access Salesforce tenants belonging to Drift customers.
- In Cloudflare’s environment, the attacker enumerated Salesforce objects and examined the Case object.
- The attacker used Salesforce Bulk API 2.0 to export case text without compromising Cloudflare’s production network.
OAuth tokens can be especially dangerous because they may provide delegated, persistent access to another service. A trusted SaaS connection can therefore become an access path that is difficult to see from endpoint-security tools alone.
Google’s later Threat Horizons reporting described the broader Drift activity as a SaaS supply-chain compromise involving compromised OAuth tokens, extensive discovery, and bulk Salesforce exfiltration. Cloudflare refers to the actor as GRUB1; Google materials use UNC6395 for broader activity. Those are vendor-specific tracking labels and should not automatically be treated as proven equivalent names.
Incident timeline
| Date | What happened |
|---|---|
| August 9, 2025 | Cloudflare observed reconnaissance involving an attempted token-verification request. The request returned a 404 response and did not validate the token. |
| August 12 | The attacker accessed Cloudflare’s Salesforce tenant with a stolen credential associated with the Salesloft integration and enumerated Salesforce objects. |
| August 13–14 | The attacker queried the Case schema, counted records, studied workflows, and examined API limits. |
| August 16 | The attacker performed a final count of Case records. |
| August 17 | The attacker used Salesforce Bulk API 2.0 to extract case text in slightly more than three minutes and then attempted to delete the API job. |
| August 20 | Salesloft revoked Drift-to-Salesforce connections across its customer base. |
| August 23 | Salesforce and Salesloft notified Cloudflare about unusual Drift-related activity. |
| August 25–29 | Cloudflare disabled Drift, revoked associated credentials, removed related software and browser extensions, analyzed the data, rotated exposed API tokens, and rebuilt integrations with new credentials and stricter controls. |
| September 2 | Cloudflare published its detailed disclosure and said affected customers were notified by email and Cloudflare Dashboard notices. |
What Cloudflare customers should do now
1. Review your Cloudflare support cases
Cloudflare directed customers to the following Dashboard path:
Support > Get Help > Technical Support > My Activities
Rank #3
Use the Download Cases option to obtain records for review. Include old, closed, archived, and internal case comments where available. Prioritize cases covering outages, API troubleshooting, origin servers, access controls, databases, and integrations.
2. Search case text for secrets and sensitive details
Search downloaded records and related archives for terms such as:
"Authorization: Bearer"
"api_token"
"access_token"
"secret"
"password"
"private_key"
"client_secret"
"X-Auth-Email"
"CF-Access-Client-Secret"Also look for database credentials, SSH keys, VPN credentials, cloud access keys, session tokens, authorization headers, internal hostnames, firewall rules, and detailed origin configuration.
A pattern match does not prove that a credential is live. Confirm ownership, scope, expiration, and current status. Where exposure cannot be ruled out, revoke or rotate the credential rather than testing it in place.
3. Rotate credentials based on risk
Rotate immediately credentials that were pasted directly into a case, have broad administrative or production access, lack expiration, were reused elsewhere, or cannot be confidently ruled out as exposed.
Free tools Windows power users keep installed
One-click scans. No signup required.
Depending on the secret, actions may include:
- Revoke and recreate Cloudflare API tokens.
- Change reused passwords everywhere they were used.
- Reissue cloud, database, CI/CD, VPN, SSH, and service-account credentials.
- Invalidate active sessions and refresh tokens where supported.
- Reduce permissions and add expiration dates to replacement credentials.
Rotating only a Cloudflare token is not enough if the same secret was reused with another provider. An expired or tightly scoped credential may not require emergency rotation, but replacement is often sensible when the cost is low and exposure is uncertain.
4. Review logs for misuse
Check Cloudflare audit logs and API-token activity, along with:
- Salesforce API and connected-application activity
- Identity-provider sign-ins
- Cloud and infrastructure access logs
- CI/CD and secrets-manager activity
- DNS, firewall, Access, and Zero Trust configuration changes
The absence of suspicious activity is useful but not conclusive. A valid token may have been copied without being used, and legitimate Salesforce infrastructure can make source-IP analysis difficult.
5. Prepare for targeted phishing
Case text can reveal genuine ticket numbers, outages, customer names, configurations, and technical terminology. Attackers may use that information to impersonate Cloudflare support, a vendor, or an internal administrator.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Warn staff to be skeptical of follow-up messages that reference real cases or request credentials, emergency changes, remote access, or payment. Verify requests through known channels rather than replying to the message or using its links.
Best Value
Questions for Drift and Salesforce administrators
Organizations that used Drift with Salesforce should establish:
- Whether Drift was connected to Salesforce during the affected period
- Which OAuth credentials and scopes were in use
- Whether those credentials were revoked and reissued
- Which Salesforce objects and fields the integration could access
- Whether the connection could access Cases, Contacts, Accounts, Attachments, or custom objects
- Whether Bulk API or unusually high-volume API activity occurred
- Whether Salesforce API logs were retained for August 9–23, 2025
- Whether secrets were stored in freeform CRM fields
- Which customer records were retrieved and whether affected customers were notified
- Whether the vendor supplied indicators of compromise and a written incident report
Technical indicators for security teams
Cloudflare reported observing activity from these IP addresses:
44[.]215[.]108[.]109
208[.]68[.]36[.]90It also listed these user-agent strings and related indicators:
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsTruffleHog
Salesforce-Multi-Org-Fetcher/1.0
Salesforce-CLI/1.0
python-requests/2.32.4
Python/3.11 aiohttp/3.12.15These are Cloudflare-observed indicators, not a complete campaign-wide list. Search them in Salesforce, SIEM, proxy, identity, and cloud logs, but do not rely on indicators alone. Valid Salesforce API activity, token age, connected-application permissions, object access, and export volume should also be reviewed.
Deleting a Bulk API job does not necessarily delete audit records, downstream copies, or data already exported. Similarly, a source-IP allowlist may not identify abuse when the attacker uses legitimate cloud or Salesforce infrastructure.
What this incident means for SaaS security
The incident highlights several risks that apply beyond Cloudflare:
- SaaS-to-SaaS access can be hard to monitor. A company may secure its endpoints while overlooking a trusted application with access to sensitive CRM data.
- OAuth tokens can outlive the event that created them. Organizations need an inventory of connected applications, scopes, owners, creation dates, and expiration or revocation status.
- Freeform business fields can contain secrets. Support teams should discourage pasting credentials into tickets and use secure, purpose-built exchange mechanisms instead.
- Bulk export monitoring matters. High-volume API reads should trigger review even when no malware is present on a corporate device.
- “No production compromise” is not the same as “no data impact.” A CRM compromise can expose information that enables later intrusion, fraud, or social engineering.
Organizations should inventory third-party integrations, remove unnecessary connections, restrict access to required objects and fields, require approval for new OAuth grants, monitor bulk exports, and retain API logs long enough for forensic review. Secret-scanning and automatic redaction can reduce the chance that credentials enter support systems, although no scanner catches every encoded, truncated, or nonstandard secret.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
The precise takeaway
Cloudflare’s production network was not reported as compromised, but customer-support data in its Salesforce tenant was accessed and extracted through compromised Salesloft Drift integration credentials. Customers should not assume that every account or ticket was affected, nor should they assume that no risk exists because Cloudflare rotated 104 tokens. The practical response is to review support-case text, rotate exposed or uncertain credentials, investigate API and identity logs, and treat follow-up communications as potential phishing.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
