How big will this Drift get? Cloudflare cops to Salesloft Drift breach

The list of victims keeps growing, as yet another company — Cloudflare — today disclosed that some of its customers' data was also compromised in the Salesloft Drift breach. In a very comprehensive post mortem published Tuesday, Cloudflare's Head of Security Response Sourov Zaman, Senior Director of Threat Detection and …

[Omnipresent]

Are we surprised?

The bigger question in my mind is "why does no one give a hoot?"

We are perfectly willing to destroy society and man it's self in the never ending quest for personal wealth.

Everyone and everything has been compromised, manipulated, lied to, and fooled. Get off the internet, and for Got sakes put down the social, and the AI. Nothing is safe.

[Anonymous Coward]

Re: Are we surprised?

It’s a bit vague where the issue lay.

Drift App - for allowing compromised access into Salesforce

Salesforce - for a badly secured API

Cloudflare - for integrating the 2

… or all of the above.?!

[Omnipresent]

Re: Are we surprised?

With the emphasis being placed on inferencing, all of these are now one. They are all working together to spy and manipulate you 24/7 at all times. When you gain access to one, you gain access to all. That is why what tech is doing to society is so dangerous.

[jake]

who WASN'T targeted?

Not a single one of my clients were targeted, primarily because not a single one of them is daft enough to use Salesforce for anything. It's far cheaper to keep all that shit in-house.

[Throatwarbler Mangrove]

Re: Phew!

LI-

[Anonymous Coward]

They need to stop giving hacking groups cool names.

Everyone is queuing up to join "Lazarus Factor 27 Typhoon Sandstorm". How about we rename them to "smelly ballsack scratching finger" or "tiniest penile percentage club" - lets see how many people are rushing to join those groups!

[TheMaskedMan]

"They need to stop giving hacking groups cool names."

Indeed. A suggestion I made myself in these hallowed pages many months ago. I suspect that it's easier to swallow being compromised by someone with a cool name though - would you rather own up to being breached by the NinjaRaptor group, or the SmellyAsshole group? At least if they sound cool, you can claim you were done over by the big boys.

[RainingCatFivesAndDogs]

Cloudflare sent out an email to affected accounts, and also added a banner after login. That was a nice touch. Their email says they used Drift for a chat bot. Seems like a very expensive price to pay for tech so many technical folks dislike anyway. They say that anything in my support case history should be considered compromised.

Unfortunately if you’re not a Pro, Business, or Enterprise customer currently, you can’t follow their instructions to see what data was compromised (which requires logging into your account and accessing the support portal). You just get directed to a support article that basically says you have to pay them to access your support history, even if you used to be a paying customer.

I guess “pay up to see what we lost because we so desperately needed a chat bot” didn’t read as well so they didn’t put it in the email.