What IT pros should know about the recent Salesforce breaches

After a handful of cybersecurity incidents linked to Salesforce, including the Salesloft Drift data extortion incident and ongoing social engineering threats, industry leaders are encouraging others to prioritize system agility and careful vendor onboarding.

Google Threat Intelligence Group (GTIG) found through an independent analysis that threat cluster UNC6040, a vishing-focused and financially motivated campaign, sought to compromise organizations’ Salesforce instances for data theft and extortion. Salesforce posted online warnings about the threats at the beginning of October, with the ongoing response last updated on Oct. 17.

The attempts to breach networks via vishing, according to GTIG, “have proven particularly effective in tricking employees, often with English-speaking branches of multinational corporations, into actions that grant the attackers access or lead to the sharing of sensitive credentials, ultimately facilitating the theft of organization’s Salesforce data.”

“In all observed cases, attackers relied on manipulating end users, not exploiting any vulnerability inherent to Salesforce,” GTIG wrote.

Nicole Aranda, a Salesforce senior manager for corporate communications, told IT Brew via email that, following the most recent extortion attempts from threat actors, there is no indication that the company’s platform has been compromised, “nor is this activity related to any known vulnerability in our technology.”

“Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support,” Aranda wrote.

It’s a breach. Justin Tolman, the digital forensic subject matter expert and evangelist for e-discovery and software company Exterro, told IT Brew that, in light of the recent Salesforce breaches, companies need to prioritize securing third-party plugins that use a company’s platform, which can be done during the vendor onboarding process.

“What happens as companies grow…and in the Internet of things era that we are in, is different things are added to their software that they don’t have necessarily direct control over,” Tolman said. “If you look at a lot of the breaches that Salesforce ‘had,’ these were through breached third-party plugins that were using the Salesforce platform to then steal information.”

Tolman added that, for professionals combatting exposure through third-party resources like plug-ins, there needs to be increased focus on vendor onboarding rather than just doing a “tech check.” Some questions Tolman suggested included:

• Does your API plug in properly, and do what it says it does?
• Is there a security-by-design check?

“I do feel like as Salesforce is the owner of the ecosystem, the manager of the ecosystem, they are ultimately responsible for ensuring that the plug-ins and the third-party apps and the different things—at least if it’s officially supported by Salesforce,” Tolman said.

A customer’s perspective. Shree Reddy, the CIO of PenFed Credit Union (a customer of Salesforce that uses its agentic AI solution) told IT Brew that, in light of the recent slew of cybersecurity incidents concerning Salesforce and its customers, no organization is exempt from issues concerning cybersecurity. He pointed to the Salesforce ecosystem as having multiple technologies, and therefore multiple points of threat.

“That doesn’t take away the risk associated with it. However, in Salesforce’s open architecture, [it] also enables you to embrace concepts such as zero trust…and that gives you the option to go above and beyond what the platform provides,” Reddy said.

The Salesforce platform, Reddy added, gives customers the option to “go above and beyond” what Salesforce offers, with a set of baseline capabilities that customers can add to or adjust.

“[Salesforce’s platform] provides you to further strengthen your cybersecurity posture,” Reddy said. “In my opinion, it actually positions you for strength compared to a siloed tech stack and a siloed architecture.”

Reddy said IT pros have to build ecosystems that embrace agility via composable architecture, which is IT architecture that’s built from modular components for easy assembly and reassembly, to retain the ability to pivot a tech strategy in the face of internal and external factors.

“Agility is what makes the technology empower your business and empower our members and communities,” Reddy said. “Truly that platform strategy compared to the other siloed, segregated tech-stack view has tremendously helped us in multiple ways.”