a breach at a small vendor stays a small breach

what everyone assumed

Vendor risk is understood as proportional to the vendor. A CRM compromise would be a catastrophe; a chat widget compromise sounds like a chat widget problem, small and contained, someone else’s incident to manage. The integration had been approved once, worked daily, and never asked to be reconsidered. Every company on the customer list made the same reasonable call.

what happened

With Drift’s tokens in hand, the attackers did not need to touch any victim’s network. They authenticated into Salesforce instance after Salesforce instance, through connections each customer had approved themselves, and harvested support case data at scale. Support cases turn out to be where secrets go to rest: engineers troubleshooting under pressure had pasted AWS keys and Snowflake tokens into tickets, and those tickets now sat in the haul, each one a potential second breach.

how it surfaced

Google Cloud’s Mandiant threat intelligence team documented the campaign: data harvested from the Salesforce instances of more than 700 organizations, all reached through one integration’s stolen tokens. The victim list included Cloudflare, Palo Alto Networks, and Zscaler, companies that sell security for a living and still had a chat widget’s token standing between their support data and the internet.

An OAuth token is a key that works from anywhere and answers to nobody’s laptop, badge, or VPN.

When an integration serves hundreds of customers, its tokens carry the combined reach of all of them, so the blast radius of the vendor’s worst day is every customer connected to it. The size of the vendor and the size of the breach are separate quantities.