The Truth Behind the September 2025 Salesforce Customer Data Incidents

Reports of a "Salesforce breach" in September 2025 sparked significant alarm across the global enterprise landscape. However, investigations by leading cybersecurity firms and federal agencies clarified a critical distinction: the core Salesforce infrastructure remained secure. The incidents were not the result of a flaw in Salesforce’s proprietary code but were instead a sophisticated wave of supply-chain compromises and social engineering attacks targeting Salesforce customers and their third-party integrations.

This period marked a pivotal shift in how threat actors view Software-as-a-Service (SaaS) ecosystems. Rather than attempting to break through the front door of a hyper-scale provider, attackers targeted the "side doors"—the integrations, connected apps, and human elements that link a company’s sensitive CRM data to the rest of the web.

The Reality of the September 2025 Security Crisis

To understand the events of September 2025, one must first dismantle the headline-grabbing term "Salesforce breach." In cybersecurity, a platform breach implies that the provider's central servers or codebase were compromised. In this instance, Salesforce maintained its operational integrity. The actual crisis involved threat actors exploiting the "Shared Responsibility Model."

Under this model, Salesforce is responsible for the security of the cloud, while the customer is responsible for security in the cloud—including who they grant access to and which third-party applications they connect to their environment. The September 2025 incidents primarily exploited the latter.

The Salesloft and Drift Supply Chain Compromise

The most significant technical component of the September 2025 crisis was the compromise of Salesloft and its integrated chatbot platform, Drift. According to forensic reports, the threat actor (tracked as UNC6395) gained unauthorized access to Salesloft’s GitHub repositories earlier in 2025. During this period, the attackers exfiltrated sensitive OAuth (Open Authorization) tokens.

OAuth tokens act as digital keys. When a company integrates a tool like Drift with Salesforce, an OAuth token is generated to allow the two systems to communicate without sharing passwords. By stealing these tokens, the attackers essentially obtained "master keys" that allowed them to bypass Multi-Factor Authentication (MFA) and query Salesforce databases directly via API calls.

For many organizations, this meant that attackers could siphon out contact lists, support tickets, and sales pipelines without ever needing a username or password. Because the traffic originated from a "trusted" integration, it often bypassed traditional anomaly detection systems.

The Rise of Sophisticated Vishing Campaigns

While the Salesloft incident was a technical supply-chain failure, another group (tracked as UNC6040, often associated with the ShinyHunters collective) utilized human psychology. Throughout September 2025, a wave of "Vishing" (voice phishing) attacks targeted help-desk and call-center employees at major corporations.

In these scenarios, attackers impersonated IT support staff, using leaked internal directory information to sound authentic. They convinced employees to install what they claimed were "critical security updates" or "IT diagnostic tools." In reality, these were modified versions of the Salesforce Data Loader app or malicious "Connected Apps." Once an employee approved the installation or clicked the link provided over the phone, the attackers gained a foothold in the corporate Salesforce instance, enabling mass data exfiltration.

Chronology of the September 2025 Incidents

The following timeline illustrates how the crisis unfolded, from initial detection to the escalation of extortion demands.

• Early September 2025: High-profile security vendors, including Cloudflare, Palo Alto Networks, and Zscaler, publicly confirmed that their Salesforce environments had been accessed via the compromised Salesloft-Drift integration. These companies were among the first to detect unauthorized API calls originating from the Drift service.
• September 3–7, 2025: Salesforce took the proactive step of temporarily disabling integrations with Salesloft to contain the spread. While the primary Salesloft service was eventually re-enabled with new security protocols, the Drift application remained offline for several weeks pending a full audit.
• September 12, 2025: The FBI issued a "FLASH" alert. This advisory officially linked the activity to threat clusters UNC6040 and UNC6395. The alert provided Indicators of Compromise (IOCs), including specific IP addresses and malicious domains used in the vishing campaigns.
• September 17, 2025: The ShinyHunters group claimed to have stolen 1.5 billion Salesforce records from over 760 companies. While these numbers were likely inflated for dramatic effect, the claim intensified the pressure on affected organizations.
• Late September 2025: The situation transitioned into an extortion phase. A group calling themselves the "Scattered Lapsus$ Hunters" launched a dedicated leak site. They listed dozens of global brands—ranging from automakers like Stellantis and Jaguar Land Rover to tech giants like Google—and demanded cryptocurrency ransoms to prevent the publication of stolen CRM data.

Why These Attacks Were So Effective

From an architectural standpoint, the attacks of September 2025 were a "perfect storm" of three distinct vulnerabilities: trust in third-party integrations, the persistence of OAuth tokens, and the vulnerability of human-centric support workflows.

The "Shadow" Access Problem

Most enterprises have hundreds of "Connected Apps" within their Salesforce environments. Many of these apps were authorized years ago for a specific project and then forgotten. However, the OAuth tokens associated with them often remain active. Attackers capitalized on this "shadow access," finding dormant but high-privilege tokens that provided a silent path to sensitive data.

Bypassing MFA

The common misconception is that Multi-Factor Authentication (MFA) is a silver bullet. However, the September 2025 attacks proved otherwise. OAuth tokens, once issued, do not require MFA for subsequent API calls. Similarly, the vishing attacks used "MFA fatigue" or social engineering to trick users into approving malicious apps, effectively rendering the MFA protection moot.

The Value of Support Data

Many organizations focus their security on "Accounts" and "Opportunities." However, the attackers in September 2025 specifically targeted "Support Cases." Support tickets often contain highly sensitive technical details, internal secrets, and even passwords accidentally shared by customers. By harvesting these, the attackers gained leverage for much more effective downstream attacks.

Impact on Major Global Organizations

The ripple effects of the September 2025 incidents were felt across multiple industries. The diversity of the victims underscores that this was not a targeted attack on a single sector but a broad-spectrum exploitation of the Salesforce ecosystem.

The Automotive Sector: JLR and Stellantis

British automaker Jaguar Land Rover (JLR) faced significant operational disruptions. Reports indicated that a related cyberattack had impacted their manufacturing capabilities as early as late August, with the recovery process continuing through September. Meanwhile, Stellantis (the parent company of brands like Jeep and Chrysler) confirmed that contact information was leaked via a third-party service provider, advising millions of customers to be vigilant against follow-up phishing.

The Cybersecurity Industry

Perhaps the most ironic victims were the security firms themselves. Because companies like Cloudflare and Qualys use Salesforce to manage customer support and sales, the compromise of a third-party tool like Drift gave attackers a window into the records of the very companies designed to stop them. Most of these firms handled the situation with extreme transparency, proving that even the most robust security teams can be impacted by supply-chain vulnerabilities.

The Financial and Retail Sectors

Brands like Wealthsimple and luxury retailers like Dior and Louis Vuitton were also identified in various leak lists. For these companies, the risk was not just operational but reputational. The theft of high-net-worth individual (HNWI) contact data is a goldmine for future spear-phishing and executive impersonation attacks.

Critical Defense Measures for Salesforce Administrators

The events of September 2025 serve as a definitive wake-up call for SaaS security. Based on the tactics observed during this period, organizations must move beyond a "set it and forget it" approach to CRM security.

1. Conduct an OAuth Token "Archaeology"

Every organization should immediately inventory all "Connected Apps" within their Salesforce instance.

• Identify Dormant Apps: Remove any application that has not been used in the last 90 days.
• Review Scopes: Ensure that apps only have the minimum permissions required. Does a chatbot really need "Full Access" to your database?
• Rotate Secrets: Regularly rotate the client secrets for your own custom-built connected apps.

2. Implement Strict API Monitoring

The bulk of the data exfiltration in September 2025 happened via APIs.

• Set Baselines: Establish a baseline for "normal" API traffic. A sudden spike in GET requests for the Account or Case objects should trigger an immediate lockdown.
• Restrict IP Ranges: Where possible, restrict API access to known, trusted IP ranges associated with your third-party providers.

3. Harden the Human Layer Against Vishing

Technical controls cannot stop an employee from being tricked over the phone.

• Out-of-Band Verification: Train help-desk staff to always verify the identity of a caller using a secondary channel (e.g., a Slack message or a corporate authentication app) before performing any sensitive action.
• "No Link" Policy: Establish a firm policy that IT support will never ask an employee to download software or click a link provided over a phone call.

4. Transition to Phishing-Resistant MFA

Standard SMS-based or push-notification MFA can be bypassed. Organizations should transition to FIDO2-compliant hardware security keys (like YubiKeys). These are much harder to spoof or bypass via social engineering, as they require physical presence and are cryptographically bound to the legitimate login domain.

5. Adopt a "SaaS Security Posture Management" (SSPM) Tool

Manual audits are no longer sufficient for complex environments. SSPM tools can continuously monitor Salesforce for misconfigurations, overly permissive sharing settings, and unauthorized connected apps, providing real-time alerts when the security posture deviates from the corporate standard.

The Future of SaaS Ecosystem Security

The September 2025 crisis was not an isolated incident; it was a symptom of a broader trend. As enterprises move more of their core business logic to the cloud, the "identity" of the user and the "trust" between applications become the primary targets.

Attackers have realized that the easiest way to steal a billion records is not to hack the database, but to hack the integration that already has permission to read the database. This "identity-centric" threat landscape requires a Zero Trust approach to every connection, no matter how reputable the vendor might be.

Summary of the 2025 Incident

FAQ: Frequently Asked Questions

Was Salesforce itself hacked in September 2025?

No. The core Salesforce infrastructure and codebase remained secure. The data theft occurred through third-party integrations (like Drift) and social engineering of individual customer employees.

How did the Salesloft/Drift breach happen?

Attackers compromised Salesloft’s GitHub repositories, stealing OAuth tokens that allowed them to access the Salesforce instances of Salesloft's customers without needing passwords or MFA.

Which companies were affected by the 2025 Salesforce news?

Dozens of global organizations were impacted, including Cloudflare, Palo Alto Networks, Zscaler, Jaguar Land Rover, Stellantis, and Google. Most suffered from limited data exfiltration rather than a total system compromise.

What data was stolen during these attacks?

The stolen data primarily consisted of "Salesforce Objects" such as Accounts, Contacts, and Cases (support tickets). In some instances, internal secrets like AWS keys or Snowflake tokens stored within support tickets were also harvested.

How can I protect my Salesforce instance from similar attacks?

The most effective measures include auditing and pruning "Connected Apps," implementing strict API monitoring, training staff against vishing, and enforcing phishing-resistant MFA across the organization.

Is it safe to use third-party apps with Salesforce?

Yes, but it requires active management. Organizations must follow the principle of least privilege, ensuring that every connected app has the minimum necessary access and that integrations are regularly audited for security.

Conclusion

The "Salesforce breach" narrative of September 2025 is a masterclass in modern cyber-risk. It highlights that in a hyper-connected world, your security is only as strong as your weakest integration. While Salesforce continues to provide a robust and secure platform, the responsibility for managing the "web of trust" between apps rests squarely on the shoulders of the enterprise. By learning from the Salesloft compromise and the vishing waves of 2025, organizations can move toward a more resilient, identity-centric security model that protects their most valuable asset: customer trust.