Every public data breach

Disclosed this week44On record26,355

44 disclosed this week · 26,355 on record

Cloudflare

Disclosed Sep 2, 2025Confirmed

Official notice

Cloudflare Salesforce data stolen via Salesloft Drift OAuth tokens

Cloudflare said an attacker used stolen Drift tokens to access its Salesforce support case system between August 12 and 17, 2025, taking customer contact data and support case contents that included 104 Cloudflare API tokens, which it rotated.

What is known

People affectedNot stated in the sources we have
DisclosedSep 2, 2025
DiscoveredAug 23, 2025
AttackSupply chain
Data exposedNamesEmailsPhone numbersAPI keysCredentials and tokensOther
SectorTech · US
StatusConfirmed
Part ofSalesloft drift (2025)

Sources

The organizationblog.cloudflare.com
Cloudflare statement on the Salesloft Drift incident
Newsbleepingcomputer.com
Cloudflare hit by data breach in Salesloft Drift supply chain attack
Newsdriftbreach.com
Salesloft Drift Breach: Track the Salesforce Incident (Nudge Security)

Notices filed

TotalSep 2, 2025
ResearchCount not stated

Same campaign

Telus DigitalSupply chain exposed messages, credentials and tokens, source code and financial details.Supply chainTechCAUnverifiedMar 11GrubhubSupply chain exposed names and emails.Supply chainRetailUSUnverifiedJan 15ToastSupply chain exposed names, emails and addresses.Supply chainTechUSSep 18, 2025AvalaraSupply chain exposed names, emails, phone numbers and financial details.Supply chainTechUSSep 12, 2025DynatraceSupply chain exposed names and emails.Supply chainTechUSSep 8, 2025PantheonSupply chain exposed names and emails.Supply chainTechUSSep 5, 2025FastlySupply chain exposed names and emails.Supply chainTechUSSep 5, 2025TenableSupply chain exposed names, emails and phone numbers.Supply chainTechUSSep 4, 2025RubrikSupply chain exposed names and emails.Supply chainTechUSUnverifiedSep 4, 2025QualysSupply chain exposed names and emails.Supply chainTechUSSep 4, 2025PagerDutySupply chain exposed names and emails.Supply chainTechUSSep 4, 2025JFrogSupply chain exposed names and emails.Supply chainTechUSUnverifiedSep 4, 2025ElasticSupply chain exposed emails and credentials and tokens.Supply chainTechUSSep 4, 2025CyberArkSupply chain exposed names and emails.Supply chainTechUSUnverifiedSep 4, 2025Cato NetworksSupply chain exposed names and emails.Supply chainTechILUnverifiedSep 4, 2025BeyondTrustSupply chain exposed names and emails.Supply chainTechUSUnverifiedSep 4, 2025NutanixSupply chain exposed names, emails and phone numbers.Supply chainTechUSSep 3, 2025ProofpointSupply chain exposed names and emails.Supply chainTechUSSep 2, 2025Palo Alto NetworksSupply chain exposed names, emails and phone numbers.Supply chainTechUSSep 2, 2025SpyCloudSupply chain exposed names and emails.Supply chainTechUSSep 1, 2025EskerSupply chain exposed names, emails, phone numbers and employment records.Supply chainTechFRSep 1, 2025ZscalerSupply chain exposed names, emails and phone numbers.Supply chainTechUSAug 30, 2025BugcrowdSupply chain exposed names and emails.Supply chainTechUSAug 27, 2025SalesloftStolen Drift AI chatbot OAuth tokens used to raid customer Salesforce instancesSupply chainTechUSUnverifiedAug 26, 2025

Other breaches at Cloudflare

Nation-state actor uses Okta-stolen tokens to breach Cloudflare Atlassian systemsHacking exposed internal documents, source code and credentials and tokens.HackingTechUSFeb 1, 2024
History of this record
Added2026-09-25
First recordedby seedSource

First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.

Everything about Cloudflare