Cloudflare
Company Details
Linkedin ID:
cloudflare
Website:
Employees number:
6,599
Number of followers:
1,125,000
NAICS:
541514
Industry Type:
Homepage:
cloudflare.com
IP Addresses:
0
Company ID:
CLO_2342578
Scan Status:
In-progress
Cloudflare Company CyberSecurity Posture
cloudflare.com
Cloudflare, Inc. (NYSE: NET) is the leading connectivity cloud company. It empowers organizations to make their employees, applications and networks faster and more secure everywhere, while reducing complexity and cost. Cloudflare’s connectivity cloud delivers the most full-featured, unified platform of cloud-native products and developer tools, so any organization can gain the control they need to work, develop, and accelerate their business. Powered by one of the world’s largest and most interconnected networks, Cloudflare blocks billions of threats online for its customers every day. It is trusted by millions of organizations – from the largest brands to entrepreneurs and small businesses to nonprofits, humanitarian groups, and governments across the globe.
Cloudflare A.I CyberSecurity Scoring
Cloudflare Risk Score (AI oriented)Between 550 and 599
Cloudflare
Updated:
- Powered by our proprietary A.I cyber incident model
- Insurance preferes TPRM score to calculate premium
Cloudflare Global Score (TPRM)XXXX
Cloudflare
- Instant access to detailed risk factors
- Benchmark vs. industry & size peers
- Vulnerabilities
- Findings
Cloudflare Company CyberSecurity News & History
Past Incidents
12
Attack Types
4
SalesloftCloudflare, F5 and Palo Alto Networks: Hackers exploit security testing apps to breach Fortune 500 firms
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Cybercriminals Exploit Misconfigured Security Training Apps to Breach Fortune 500 Cloud Environments Threat actors are actively targeting misconfigured web applications used for security training and penetration testing such as DVWA, OWASP Juice Shop, Hackazon, and bWAPP to infiltrate cloud environments belonging to Fortune 500 companies and security vendors. A recent investigation by Pentera, an automated penetration testing firm, uncovered 1,926 exposed, vulnerable instances of these intentionally insecure apps on AWS, GCP, and Azure, many tied to overly permissive IAM (Identity and Access Management) roles. The exposed applications, often deployed with default credentials or excessive privileges, provided attackers with pathways to cloud storage (S3, GCS, Azure Blob), Secrets Manager access, container registries, and full admin control over compromised environments. Among the affected organizations were Cloudflare, F5, and Palo Alto Networks, all of which have since remediated the issues after being notified by Pentera. ### Active Exploitation Confirmed Pentera’s findings confirmed that the threat was not theoretical attackers had already exploited these misconfigurations to: - Deploy crypto miners (primarily XMRig for Monero mining) on compromised systems. - Install webshells (e.g., *filemanager.php*), enabling file manipulation and remote command execution. - Establish persistence via a watchdog.sh script, which reinstalled itself from a base64-encoded backup and re-downloaded mining tools from GitHub if removed. In one case, 20% of the 616 discovered DVWA instances contained malicious artifacts, including AES-256-encrypted tools downloaded from Dropbox and a webshell with hardcoded credentials, suggesting possible ties to operators in Europe/Minsk (UTC+3). ### Root Causes & Risks The vulnerabilities stemmed from: - Public exposure of testing apps meant for internal use. - Overly permissive IAM roles, violating the least-privilege principle. - Default or unchanged credentials, allowing easy takeover. - Lack of isolation between testing and production environments. Pentera’s report highlights the need for organizations to inventory all cloud resources, enforce strict IAM policies, and automatically expire temporary assets to mitigate such risks. The incident underscores how even security-focused firms can fall victim to overlooked misconfigurations in non-production systems.
Salesloft and Cloudflare: Palo Alto Networks, Zscaler, Cloudflare hit by the latest data breach
Cyber Attack
Rankiteo Explanation
Attack threatening the organization's existence
Description: Palo Alto Networks, Zscaler, and Cloudflare Hit by Third-Party Salesforce Breach A recent supply chain attack targeting Salesloft Drift, a third-party Salesforce integration, has compromised sensitive data from Palo Alto Networks, Zscaler, and Cloudflare, among hundreds of other organizations. The breach, disclosed on Tuesday, stemmed from stolen OAuth tokens used to access Salesforce environments via the Drift Connected App, enabling threat actors to exfiltrate business contact information, support case details, and, in some cases, credentials. ### Key Details of the Attack - Timeline: The malicious activity occurred from August 8 onward, with attackers leveraging Python/3.11 aiohttp/3.12.15 user agent strings and known threat actor IPs to execute Salesforce Object Query Language (SOQL) queries on objects like Account, Contact, Case, and Opportunity records. - Data Exposed: Primarily business contact information (names, emails, phone numbers, job titles), but also support case contents, including logs, tokens, and passwords shared with vendors. Some customers stored sensitive data in insecure notes fields, increasing exposure. - Attack Method: The threat actor mass-exfiltrated data, scanned for credentials, and deleted queries to obscure forensic traces an anti-forensics tactic. - Impact on Vendors: - Palo Alto Networks confirmed the breach was isolated to its CRM platform, with no impact on its products or services. Exposed data included customer contact and sales account details. - Zscaler reported similar exposure, noting that product licensing and commercial information may have been compromised. - Cloudflare took responsibility for enabling the third-party integration, acknowledging that support case data including customer-shared credentials was accessed. The company urged affected users to rotate compromised credentials. ### Industry Reactions and Lessons - Transparency & Accountability: Cloudflare’s disclosure was praised for its technical detail and ownership of the incident, setting a benchmark for incident response. Analysts highlighted the need for stronger SaaS security and third-party risk management. - SaaS Supply Chain Risks: The attack underscores vulnerabilities in OAuth token security and the challenges of monitoring API-level integrations, particularly as agentic AI frameworks expand. Experts warned that misconfigurations and stolen tokens remain a persistent threat. - Zero Trust & Contractual Safeguards: Recommendations included revoking unused OAuth tokens, enforcing token expiration, and auditing third-party contracts for breach notification, data handling, and sub-processor transparency. - Phishing Risks: The breach’s targeted nature leveraging real business data could fuel highly convincing phishing, smishing, and vishing campaigns, making detection harder for victims. ### Broader Implications The incident reflects the growing threat of SaaS supply chain attacks, where a single compromised vendor can expose hundreds of downstream organizations. As enterprises increasingly rely on interconnected third-party apps, securing API access, identity management, and token hygiene becomes critical to mitigating future risks.
Cloudflare: Cloudflare Zero-Day Vulnerability Enables Any Host Access Bypassing Protections
Vulnerability
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Critical Zero-Day in Cloudflare WAF Exposed Origin Servers to Bypass Attacks Security researchers from FearsOff uncovered a zero-day vulnerability in Cloudflare’s Web Application Firewall (WAF) that allowed attackers to bypass security controls and directly access protected origin servers. The flaw, discovered in October 2025, stemmed from improper handling of ACME HTTP-01 challenge paths, which are used for automated SSL/TLS certificate validation. The vulnerability enabled requests to the `/.well-known/acme-challenge/` directory to evade WAF rules entirely, even when customer configurations explicitly blocked all other traffic. Normally, this path is restricted to Certificate Authorities (CAs) for domain validation, but the flaw turned it into an unintended gateway to origin servers. Researchers demonstrated the issue on test hosts (`cf-php.fearsoff.org`, `cf-spring.fearsoff.org`, and `cf-nextjs.fearsoff.org`), where ACME path requests returned origin-generated responses including framework errors and sensitive data while normal requests were correctly blocked. The root cause was a logic error in Cloudflare’s edge network: if a requested token didn’t match a Cloudflare-managed certificate order, the WAF was completely bypassed, allowing direct access to the origin. Exploitation risks included: - Spring/Tomcat applications: Path traversal attacks exposing database credentials, API tokens, and cloud keys via actuator endpoints. - Next.js applications: Leakage of server-side rendering data through unintended public responses. - PHP applications: Exploitation of local file inclusion vulnerabilities via malicious path parameters. - Custom WAF rules: Bypass of header-based blocking for ACME path traffic. FearsOff reported the vulnerability via Cloudflare’s HackerOne bug bounty program on October 9, 2025. Cloudflare validated the issue on October 13, triaged it on October 14, and deployed a permanent fix on October 27, ensuring WAF rules now apply uniformly to all paths. The company confirmed no evidence of malicious exploitation and stated that no customer action was required.
Minecraft (Microsoft)
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: A newly disclosed Aisuru IoT botnet attack unleashed a record-breaking 29.6 Tbps DDoS assault, overwhelming major online gaming platforms, including Minecraft, on October 8, 2025. The attack, lasting mere seconds, exploited compromised IoT devices (home routers, IP cameras, DVRs) hosted under US ISPs (AT&T, Comcast, Verizon, T-Mobile, Charter), flooding servers with malicious traffic far exceeding typical mitigation thresholds. While the primary target was gaming services, the sheer scale caused widespread internet disruptions, crippling connectivity for users beyond the gaming community. Cybersecurity journalist Brian Krebs highlighted that such attacks now surpass the defensive capabilities of most organizations, posing systemic risks. Though no data breach or ransomware was involved, the outage disrupted payment processes, user access, and service availability, inflicting reputational damage and financial losses from downtime. The incident underscores the escalating threat of IoT-driven DDoS campaigns targeting high-traffic digital platforms.
Amazon Web Services, Cloudflare and Change Healthcare: Data Breach Statistics (2026) – Trends, Costs & Impact
Cyber Attack
Rankiteo Explanation
Attack without any consequences
Description: 2025 Cybersecurity Breach Landscape: Key Trends, Costs, and Major Incidents The 2025 cybersecurity threat landscape reached unprecedented levels, with data breaches inflicting severe financial and operational damage across industries. Global breach costs averaged $4.4 million, while the U.S. faced an even steeper average of $10.22 million per incident a 9.19% increase from prior years. Healthcare remained the hardest-hit sector, with breaches costing $7.42 million on average, despite a 24% decline from 2024. However, these incidents took the longest to detect and contain, averaging 279 days, underscoring persistent vulnerabilities in critical infrastructure. ### Speed and AI Drive Cost Reductions Faster detection and response times significantly mitigated financial losses. Breaches resolved in under 200 days cost $3.87 million on average, compared to $5.01 million for longer lifecycles a $1.14 million (29%) savings. The global mean time to identify a breach dropped to 181 days, while containment averaged 60 days, marking a nine-year low and reflecting the growing adoption of AI-driven security tools. Yet, only 30% of organizations extensively used AI for breach prevention, with 43% employing it in limited capacities and 27% lacking any integration. ### Healthcare Under Siege Healthcare dominated breach activity, accounting for the highest volume of incidents and financial impact. The Change Healthcare ransomware attack the largest in U.S. history exposed 190 million individuals’ data, disrupting one-third of all U.S. patient records and costing providers $14 billion in delayed claims. Over 80% of affected clinicians reported revenue losses, with half dipping into personal funds to sustain operations. Despite a 275-incident decline from 2024, healthcare led all sectors in breach volume, with 811 incidents in 2023 more than double 2022’s total. ### Credential Theft and Supply Chain Risks A June 2025 leak exposed 16 billion usernames, emails, and passwords, one of the largest credential dumps ever, compiled from infostealer malware and prior breaches. Meanwhile, supply chain attacks proved devastating, with just 79 incidents exposing 78.3 million records an average of 991,000 per breach. The top five breaches alone accounted for 131 million exposed records, highlighting how a small number of high-impact incidents skew overall exposure. ### Attack Vectors and Global Trends - System intrusion (ransomware, vulnerability exploits) caused 53% of all breaches, the most common attack type. - Social engineering (phishing, pretexting) accounted for 17% of breaches, demonstrating the persistent threat of human-targeted tactics. - The U.S. reported 1,732 breaches in H1 2025, exposing 165.7 million records (avg. 95,700 per breach), while accounting for 56% of global breaches though only 48.7% of third-party violations, suggesting a higher rate of direct attacks. - Manufacturing saw a 353% surge in breaches from 2020 (70 incidents) to 2024 (317), driven by industrial digitization. - Financial services breaches spiked, rising from 269 in 2022 to 742 in 2023, remaining elevated in 2024. ### Notable Breaches and Threat Actors - BlackCat ransomware inflicted $3.09 billion in losses, disrupting healthcare and exposing sensitive patient data. - ShinyHunters breached Mixpanel, leaking Pornhub user data after an unmet ransom demand. - A misconfigured API in Salesforce led to a third-party breach, while a Linux server attack (BPFDoor) resulted in a $96.9 million fine, suspected to be state-sponsored. - A 631GB unsecured Chinese database exposed PII on nearly every citizen, one of the country’s largest surveillance-related leaks. ### Global Recovery and Resilience Recovery timelines varied by region: - U.S.: 51% of organizations recovered from ransomware within a week, at an average cost of $1.91 million. - Germany: 64% recovered in a week, costing $1.56 million. - UAE: 63% recovered in a week, with costs at $1.41 million. - Japan: 50% recovered in a week, averaging $0.67 million the lowest among surveyed nations. ### Record-Breaking Threat Activity - Cyberattacks occurred every 39 seconds, totaling 2,200 daily. - Microsoft detected 600 million hostile signals daily in 2024, while AWS tracked 750 million malicious instances per day. - Cloudflare mitigated 7.3 million DDoS attacks in Q2 2025, underscoring the intensity of automated threats. - Verizon’s 2025 Data Breach Investigations Report analyzed 22,052 incidents across 139 countries, confirming 12,195 breaches the highest caseload on record. The 2025 breach landscape revealed a sophisticated, persistent threat environment, where speed, AI adoption, and sector-specific vulnerabilities dictated financial and operational outcomes. While progress in detection and response reduced costs, the scale of exposure particularly in healthcare and supply chains demonstrated the urgent need for stronger defenses against evolving attack vectors.
Cloudflare
Ransomware
Rankiteo Explanation
Attack threatening the organization’s existence
Description: Cybersecurity researchers have identified a growing trend among ransomware affiliates and advanced persistent threat actors who are leveraging Cloudflare’s legitimate tunneling service, Cloudflared, to establish covert access channels into compromised networks. This sophisticated technique allows attackers to maintain persistent access while evading traditional network security controls that typically flag suspicious outbound connections. The exploitation of Cloudflared tunnels has emerged as a preferred persistence mechanism due to the service’s inherent design, which encapsulates data in additional protocols that only the tunnel endpoints can decrypt. This creates a secure communication channel that appears as legitimate traffic to security monitoring systems, effectively providing attackers with what amounts to local network access from remote locations.
Cloudflare, U.S. Department of Justice and Social Security Administration: DOGE might have misused Social Security data, Trump administration admits
Cyber Attack
Rankiteo Explanation
Attack limited on finance or reputation
Description: DOGE Employees Under Scrutiny for Alleged Election Interference and Data Misuse The U.S. Department of Justice (DOJ) has revealed in a court filing that members of Elon Musk’s "DOGE" team at the Social Security Administration (SSA) engaged in undisclosed communications with an unnamed advocacy group aiming to overturn election results in certain states. The interactions allegedly included a signed agreement that may have involved matching Social Security data with state voter rolls a potential violation of federal privacy laws. The DOGE employees have been referred for possible Hatch Act violations, which bars government officials from using their positions for political activities. According to DOJ officials, the advocacy group approached the SSA team with a request to analyze voter rolls for evidence of fraud, though the exact states targeted remain unspecified. Further concerns arose over the unauthorized use of third-party servers, including Cloudflare, to handle sensitive data contrary to a court ruling restricting access to such information. A senior adviser to Musk and the DOGE team, Steve Davis, was reportedly copied on a March 3, 2025, email containing a password-protected file with the private data of approximately 1,000 individuals from SSA systems. It remains unclear whether the data was accessed or exploited. The DOJ stated that no evidence suggests broader SSA awareness of the communications or the "Voter Data Agreement" beyond the involved DOGE members. The investigation is ongoing, with no further details on potential legal consequences or the advocacy group’s identity.
Cloudflare
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Cloudflare confirmed it was impacted by a sophisticated supply chain attack targeting the Salesloft Drift-Salesforce integration, part of a broader campaign (UNC6395) that compromised over 700 organizations. Hackers exploited stolen credentials to exfiltrate data from Cloudflare’s Salesforce support cases between August 12–17, 2024, following reconnaissance on August 9. The breach exposed: - Customer contact details (emails, phone numbers, company domains). - Support case contents, including freeform text (potentially containing API tokens, logs, or passwords shared by customers). - 104 Cloudflare API tokens, though no malicious use was detected (all tokens were rotated). While no Cloudflare infrastructure was compromised, the attack risked credential theft for downstream systems (e.g., AWS keys, Snowflake tokens). Cloudflare disabled Drift, purged Salesloft integrations, and notified affected customers, urging credential rotation and forensic reviews. The incident underscores risks from third-party SaaS integrations in enterprise environments.
Cloudflare
Cyber Attack
Rankiteo Explanation
Attack threatening the organization’s existence
Description: In 2024 Cloudflare mitigated a staggering 21.3 million DDoS attacks a 358% year-over-year jump and in Q1 2025 alone it already repelled 20.5 million assaults, including 6.6 million aimed directly at its own infrastructure during an 18-day multi-vector campaign. The surge was driven by a 509% increase in network-layer attacks, while hyper-volumetric floods exploded: over 700 events surpassed 1 Tbps or 1 billion packets per second, averaging eight daily in Q1. Emerging threats like CLDAP reflection attacks rose 3,488% quarter-over-quarter and ESP amplification attacks grew 2,301%. Even specialized gaming servers faced hyper-volumetric onslaughts up to 1.5 billion packets per second. Most alarmingly, Cloudflare disclosed it withstood a record-breaking 5.8 Tbps DDoS blast lasting 45 seconds, eclipsing its previous 5.6 Tbps record. Although fully mitigated, these figures underscore unprecedented scale and sophistication that threaten service availability and corporate stability across industries.
Cloudflare
Cyber Attack
Rankiteo Explanation
Attack that could bring to a war
Description: On October 7, 2023, amid a real-world conflict, Israeli websites providing critical information and alerts to civilians on rocket attacks were hit by a series of DDoS attacks. Cloudflare systems detected and mitigated these attacks, which were as intense as 1M requests per second. Pro-Palestinian hacktivist groups also targeted various Israeli websites and apps, including compromising an app alerting civilians about incoming rockets by sending fake alerts. Cloudflare's Threat Operations team discovered malicious mobile applications impersonating legitimate alert apps, which could access sensitive user data. These cyberattacks occurred alongside physical threats, creating a complex situation for Cloudflare and the affected organizations to manage, emphasizing the intersection of physical and cybersecurity domains during times of conflict.
Cloudflare
Cyber Attack
Rankiteo Explanation
Attack without any consequences
Description: Internet infrastructure company Cloudflare suffered one of the largest volumetric distributed denials of service (DDoS) attacks. The attack lasted less than 15 seconds and was launched from a botnet of approximately 6,000 unique bots and originated from 112 countries around the world. The company immediately detected and mitigated a 15.3 million request-per-second (rps) DDoS attack. The attack was aimed at a “crypto launchpad” which is “used to surface Decentralized Finance projects to potential investors.”
Cloudflare
Breach
Rankiteo Explanation
Attack with significant impact with customers data leaks
Description: Cloudflare was disclosing a lot of private data, including login passwords and authentication cookies. Uber, Fitbit, 1Password, and OKCupid are just a few of the big names affected by the Cloudbleed security flaw in Cloudflare servers. Because mobile apps are created with the same backends as browsers for HTTPS (SSL/TLS) termination and content delivery, they are likewise impacted by Cloudbleed. The fact that Cloudflare directed Ormandy to the company's bug bounty programme and offered the expert a t-shirt as payment in lieu of cash is highly unusual.
Cloudflare Company Scoring based on AI Models
Cyber Incidents Likelihood 3 - 6 - 9 months
A.I Risk Score Likelihood 3 - 6 - 9 months
Underwriter Stats for Cloudflare
Incidents vs Computer and Network Security Industry Average (This Year)
Cloudflare has 41.84% more incidents than the average of same-industry companies with at least one recorded incident.
Incidents vs All-Companies Average (This Year)
Cloudflare has 49.25% more incidents than the average of all companies with at least one recorded incident.
Incident Types Cloudflare vs Computer and Network Security Industry Avg (This Year)
Cloudflare reported 2 incidents this year: 1 cyber attacks, 0 ransomware, 0 vulnerabilities, 1 data breaches, compared to industry peers with at least 1 incident.
Incident History — Cloudflare (X = Date, Y = Severity)
Cloudflare cyber incidents detection timeline including parent company and subsidiaries
Cloudflare Company Subsidiaries
Cloudflare, Inc. (NYSE: NET) is the leading connectivity cloud company. It empowers organizations to make their employees, applications and networks faster and more secure everywhere, while reducing complexity and cost. Cloudflare’s connectivity cloud delivers the most full-featured, unified platform of cloud-native products and developer tools, so any organization can gain the control they need to work, develop, and accelerate their business. Powered by one of the world’s largest and most interconnected networks, Cloudflare blocks billions of threats online for its customers every day. It is trusted by millions of organizations – from the largest brands to entrepreneurs and small businesses to nonprofits, humanitarian groups, and governments across the globe.
Loading...
Cloudflare Similar Companies
NETWORK-SECURITY-SOLUTIONS
## Our core business We manage linux / unix server infrastructures and build the efficient and secure networking environments using hardware cutting edge technologies suited to the needs of the project and the client. We believe in quality, opposed to quantity. Our company consists of highly
Palo Alto Networks
Palo Alto Networks, the global cybersecurity leader, is shaping the cloud-centric future with technology that is transforming the way people and organizations operate. Our mission is to be the cybersecurity partner of choice, protecting our digital way of life. We help address the world's greatest s
CrowdStrike
CrowdStrike (Nasdaq: CRWD), a global cybersecurity leader, has redefined modern security with the world’s most advanced cloud-native platform for protecting critical areas of enterprise risk — endpoints and cloud workloads, identity and data. Powered by the CrowdStrike Security Cloud and world-clas
.png)
Cloudflare CyberSecurity News
January 21, 2026 09:41 AM
Top 10: Construction Cybersecurity Solutions
As construction businesses begin to form a more digital backbone, cybersecurity is a vital feature to include when it comes to building...
January 20, 2026 11:05 PM
Cloudflare whacks WAF bypass bug that opened side door for attackers
Cloudflare has fixed a flaw in its web application firewall (WAF) that allowed attackers to bypass security rules and directly access origin...
January 20, 2026 11:12 AM
Cloudflare Fixes ACME Validation Bug Allowing WAF Bypass to Origin Servers
Cloudflare patched an ACME HTTP-01 validation flaw that disabled WAF protections and let unauthorized requests reach origin servers.
January 20, 2026 05:03 AM
Cloudflare Zero-Day Flaw Allows Attackers to Bypass Security and Access Any Host
A critical zero-day vulnerability in Cloudflare's Web Application Firewall (WAF) allowed attackers to bypass security controls and directly...
January 19, 2026 10:58 PM
Cloudflare Zero-Day Vulnerability Allows Unlimited Host Access, Bypassing Protections
A newly discovered zero-day vulnerability in Cloudflare's Web Application Firewall (WAF) has raised significant security concerns.
January 19, 2026 07:15 PM
Cloudflare Fixes Zero-Day Flaw That Allowed Attackers To Bypass Web Application Firewall
January 19, 2026 04:20 PM
Cloudflare Zero-Day Vulnerability Enables Any Host Access Bypassing Protections
A critical zero-day vulnerability in Cloudflare's Web Application Firewall (WAF) allowed attackers to bypass security controls and directly...
January 16, 2026 04:47 PM
Cloudflare Acquired Open-source Web Framework Astro to Supercharge Development
Cloudflare has acquired the team behind Astro, the popular open-source web framework for building fast, content-driven sites.
January 16, 2026 09:28 AM
New Cloudflare report warns of a ‘technical glass ceiling’ stifling AI growth and weakening cybersecurity
New research shows that organisations modernising applications are three times more likely to realise AI value, while those clinging to...
Frequently Asked Questions
Explore insights on cybersecurity incidents, risk posture, and Rankiteo's assessments.
Cloudflare CyberSecurity History Information
Official Website of Cloudflare
The official website of Cloudflare is https://www.cloudflare.com.
Cloudflare’s AI-Generated Cybersecurity Score
According to Rankiteo, Cloudflare’s AI-generated cybersecurity score is 592, reflecting their Very Poor security posture.
How many security badges does Cloudflare’ have ?
According to Rankiteo, Cloudflare currently holds 0 security badges, indicating that no recognized compliance certifications are currently verified for the organization.
Has Cloudflare been affected by any supply chain cyber incidents ?
According to Rankiteo, Cloudflare has been affected by a supply chain cyber incident involving Salesloft, with the incident ID SALCLO1768392789.
Does Cloudflare have SOC 2 Type 1 certification ?
According to Rankiteo, Cloudflare is not certified under SOC 2 Type 1.
Does Cloudflare have SOC 2 Type 2 certification ?
According to Rankiteo, Cloudflare does not hold a SOC 2 Type 2 certification.
Does Cloudflare comply with GDPR ?
According to Rankiteo, Cloudflare is not listed as GDPR compliant.
Does Cloudflare have PCI DSS certification ?
According to Rankiteo, Cloudflare does not currently maintain PCI DSS compliance.
Does Cloudflare comply with HIPAA ?
According to Rankiteo, Cloudflare is not compliant with HIPAA regulations.
Does Cloudflare have ISO 27001 certification ?
According to Rankiteo,Cloudflare is not certified under ISO 27001, indicating the absence of a formally recognized information security management framework.
Industry Classification of Cloudflare
Cloudflare operates primarily in the Computer and Network Security industry.
Number of Employees at Cloudflare
Cloudflare employs approximately 6,599 people worldwide.
Subsidiaries Owned by Cloudflare
Cloudflare presently has no subsidiaries across any sectors.
Cloudflare’s LinkedIn Followers
Cloudflare’s official LinkedIn profile has approximately 1,125,000 followers.
NAICS Classification of Cloudflare
Cloudflare is classified under the NAICS code 541514, which corresponds to Others.
Cloudflare’s Presence on Crunchbase
No, Cloudflare does not have a profile on Crunchbase.
Cloudflare’s Presence on LinkedIn
Yes, Cloudflare maintains an official LinkedIn profile, which is actively utilized for branding and talent engagement, which can be accessed here: https://www.linkedin.com/company/cloudflare.
Cybersecurity Incidents Involving Cloudflare
As of January 21, 2026, Rankiteo reports that Cloudflare has experienced 12 cybersecurity incidents.
Number of Peer and Competitor Companies
Cloudflare has an estimated 3,288 peer or competitor companies worldwide.
What types of cybersecurity incidents have occurred at Cloudflare ?
Incident Types: The types of cybersecurity incidents that have occurred include Ransomware, Breach, Vulnerability and Cyber Attack.
What was the total financial impact of these incidents on Cloudflare ?
Total Financial Loss: The total financial loss from these incidents is estimated to be $3.09 billion.
How does Cloudflare detect and respond to cybersecurity incidents ?
Detection and Response: The company detects and responds to cybersecurity incidents through an incident response plan activated with cloudflare (august 23), incident response plan activated with zscaler, incident response plan activated with palo alto networks, incident response plan activated with salesloft, incident response plan activated with google, and third party assistance with mandiant (for salesloft investigation), third party assistance with google threat intelligence, and containment measures with salesloft revoked all drift-to-salesforce connections (pre-notification), containment measures with cloudflare disabled drift user accounts and purged salesloft software, containment measures with google revoked compromised workspace tokens and disabled drift integration, containment measures with salesloft took drift platform offline and paused salesforce integrations, and remediation measures with credential rotation (cloudflare rotated 104 api tokens), remediation measures with customer notifications via email/dashboard banners (cloudflare, palo alto networks), remediation measures with forensic investigations across affected organizations, remediation measures with salesforce instance audits for unauthorized access, and recovery measures with re-establishing secure integrations (timeline unclear), recovery measures with enhanced monitoring of salesforce/salesloft environments, and communication strategy with public blog posts by cloudflare, zscaler, palo alto networks, communication strategy with customer advisories with actionable steps (e.g., disconnect salesloft, rotate credentials), communication strategy with google’s updated threat advisory (august 2024), and enhanced monitoring with likely implemented by affected companies (not detailed), and containment measures with rotation of credentials, review of salesforce login history and audit trails, revocation of unused oauth tokens, enforcement of token expiration, and remediation measures with strengthening saas environments and toolchain security, periodic review of third-party contracts for security language, enhanced monitoring of api access logs, and communication strategy with public disclosures via blogs and statements, customer advisories to rotate credentials, transparency about incident details and responsibility, and enhanced monitoring with review of salesforce event monitoring logs, hunting for suspicious login attempts and unusual data access patterns, monitoring for python/3.11 aiohttp/3.12.15 user agent string and known threat actor ip addresses, and third party assistance with fearsoff (security researchers), and containment measures with permanent fix deployed to ensure waf rules apply uniformly to all paths, and remediation measures with cloudflare validated and triaged the issue, deploying a fix on october 27, 2025, and communication strategy with public disclosure via hackerone and company statement, and third party assistance with pentera (automated penetration testing firm), and containment measures with remediation of misconfigurations by affected organizations, and remediation measures with inventory of cloud resources, remediation measures with enforcement of strict iam policies, remediation measures with automatic expiration of temporary assets, and law enforcement notified with yes (doj investigation)..
Incident Details
Can you provide details on each incident ?
Title: Cloudflare Suffers Massive DDoS Attack
Description: Internet infrastructure company Cloudflare suffered one of the largest volumetric distributed denials of service (DDoS) attacks.
Type: DDoS Attack
Attack Vector: Distributed Denial of Service (DDoS)
Title: Cloudbleed Security Flaw in Cloudflare Servers
Description: Cloudflare was disclosing a lot of private data, including login passwords and authentication cookies. Uber, Fitbit, 1Password, and OKCupid are just a few of the big names affected by the Cloudbleed security flaw in Cloudflare servers. Because mobile apps are created with the same backends as browsers for HTTPS (SSL/TLS) termination and content delivery, they are likewise impacted by Cloudbleed. The fact that Cloudflare directed Ormandy to the company's bug bounty programme and offered the expert a t-shirt as payment in lieu of cash is highly unusual.
Type: Data Breach
Attack Vector: Cloudbleed Security Flaw
Vulnerability Exploited: Cloudbleed
Title: DDoS and Hacktivist Attacks on Israeli Websites and Apps
Description: On October 7, 2023, Israeli websites providing critical information and alerts to civilians on rocket attacks were hit by a series of DDoS attacks. Cloudflare systems detected and mitigated these attacks, which were as intense as 1M requests per second. Pro-Palestinian hacktivist groups also targeted various Israeli websites and apps, including compromising an app alerting civilians about incoming rockets by sending fake alerts. Cloudflare's Threat Operations team discovered malicious mobile applications impersonating legitimate alert apps, which could access sensitive user data. These cyberattacks occurred alongside physical threats, creating a complex situation for Cloudflare and the affected organizations to manage, emphasizing the intersection of physical and cybersecurity domains during times of conflict.
Date Detected: 2023-10-07
Type: DDoS, Hacktivism, Malware
Attack Vector: DDoSMalicious mobile applications
Threat Actor: Pro-Palestinian hacktivist groups
Motivation: Political, Disruption
Title: Cloudflare DDoS Attacks 2024-2025
Description: In 2024 Cloudflare mitigated a staggering 21.3 million DDoS attacks—a 358% year-over-year jump—and in Q1 2025 alone it already repelled 20.5 million assaults, including 6.6 million aimed directly at its own infrastructure during an 18-day multi-vector campaign. The surge was driven by a 509% increase in network-layer attacks, while hyper-volumetric floods exploded: over 700 events surpassed 1 Tbps or 1 billion packets per second, averaging eight daily in Q1. Emerging threats like CLDAP reflection attacks rose 3,488% quarter-over-quarter and ESP amplification attacks grew 2,301%. Even specialized gaming servers faced hyper-volumetric onslaughts up to 1.5 billion packets per second. Most alarmingly, Cloudflare disclosed it withstood a record-breaking 5.8 Tbps DDoS blast lasting 45 seconds, eclipsing its previous 5.6 Tbps record. Although fully mitigated, these figures underscore unprecedented scale and sophistication that threaten service availability and corporate stability across industries.
Type: DDoS
Attack Vector: network-layer attacksCLDAP reflection attacksESP amplification attacks
Title: Abuse of Cloudflare’s Tunneling Service by Ransomware Groups
Description: Cybersecurity researchers have identified a growing trend among ransomware affiliates and advanced persistent threat actors leveraging Cloudflare’s legitimate tunneling service, Cloudflared, to establish covert access channels into compromised networks. This sophisticated technique allows attackers to maintain persistent access while evading traditional network security controls.
Type: Ransomware
Attack Vector: VPN exploitationRemote desktop protocol attacksCloudflared tunnels
Threat Actor: BlackSuitRoyalAkiraScattered SpiderMedusaHunter International
Motivation: Maintain persistent access and establish command and control channels
Title: Widespread Data Theft Campaign Targeting Salesforce via Salesloft Drift Integration
Description: A sophisticated supply chain attack targeted hundreds of organizations globally by exploiting the Salesloft Drift integration with Salesforce. Threat actors (tracked as UNC6395 by Mandiant) exfiltrated sensitive customer data, including AWS access keys, Snowflake tokens, and business contact details, between August 8–18, 2024. Affected companies include Cloudflare, Zscaler, Palo Alto Networks, and potentially over 700 others. The attack leveraged stolen credentials and compromised authentication tokens within the Drift AI chatbot platform, which Salesloft acquired in 2023. Salesloft has since taken Drift offline and paused Salesforce integrations as a precautionary measure.
Date Detected: 2024-08-13 (initial warnings by Mandiant)
Date Publicly Disclosed: 2024-08-27 (confirmations by Cloudflare, Zscaler, Palo Alto Networks)
Type: Data Breach
Attack Vector: Compromised Third-Party Integration (Salesloft Drift)Stolen Authentication TokensAPI Abuse
Vulnerability Exploited: Weak Authentication Token Management in DriftOver-Permissive Salesforce Integrations
Threat Actor: UNC6395 (tracked by Mandiant)
Motivation: Credential Harvesting for Further AttacksData Exfiltration for Resale/ExploitationPotential Espionage or Financial Gain
Title: Massive DDoS Attack by Aisuru IoT Botnet Disrupts Major Online Gaming Platforms
Description: A newly disclosed attack campaign linked to the IoT botnet Aisuru led to a massive surge in malicious traffic, temporarily disrupting major online gaming platforms with nearly 29.6 Tbps of DDoS packets. The incident lasted only a few seconds on October 8, 2025, primarily leveraging compromised devices (home routers, IP cameras, and DVRs) hosted under leading US ISPs like AT&T, Comcast, Verizon, T-Mobile, and Charter. The attacks targeted ISPs serving online gaming communities such as Minecraft, resulting in widespread Internet disruption beyond the gaming sector.
Date Detected: 2025-10-08
Type: DDoS Attack
Attack Vector: Compromised IoT DevicesDDoS Amplification
Threat Actor: Aisuru IoT Botnet
Title: Change Healthcare Ransomware Attack
Description: The Change Healthcare ransomware attack stands as the largest healthcare data breach in US history. The breach exposed the personal and medical data of an estimated 190 million individuals, impacting more than half of the US population. The attack disrupted nearly one-third of all US patient records, given that Change Healthcare processes roughly 15 billion healthcare transactions each year. The operational fallout was severe, with delayed claims totaling approximately $14 billion, and surveys revealing that 80% of affected clinicians experienced revenue losses. More than half reported using personal funds to keep their practices operating during the disruption.
Date Publicly Disclosed: June 2025
Type: Ransomware
Attack Vector: System Intrusion
Threat Actor: BlackCat group
Motivation: Extortion
Title: Salesforce Data Breach via Salesloft Drift Third-Party Integration
Description: A supply chain attack involving the compromise of OAuth tokens from the Salesloft Drift third-party application, leading to mass exfiltration of sensitive data from Salesforce objects such as Account, Contact, Case, and Opportunity records. The attack impacted hundreds of organizations, including Palo Alto Networks, Zscaler, and Cloudflare.
Type: Supply Chain Attack
Attack Vector: Compromised OAuth tokens via third-party integration (Salesloft Drift)
Vulnerability Exploited: Misconfigured or stolen OAuth tokens, insufficient monitoring of API access logs
Motivation: Data exfiltration for credential harvesting, potential further attacks or dark web sales
Title: Critical Zero-Day in Cloudflare WAF Exposed Origin Servers to Bypass Attacks
Description: Security researchers from FearsOff uncovered a zero-day vulnerability in Cloudflare’s Web Application Firewall (WAF) that allowed attackers to bypass security controls and directly access protected origin servers. The flaw stemmed from improper handling of ACME HTTP-01 challenge paths, which are used for automated SSL/TLS certificate validation. The vulnerability enabled requests to the `/.well-known/acme-challenge/` directory to evade WAF rules entirely, turning it into an unintended gateway to origin servers.
Date Detected: 2025-10
Date Resolved: 2025-10-27
Type: Zero-Day Vulnerability
Attack Vector: ACME HTTP-01 challenge path bypass
Vulnerability Exploited: Improper handling of ACME HTTP-01 challenge paths in Cloudflare WAF
Title: Cybercriminals Exploit Misconfigured Security Training Apps to Breach Fortune 500 Cloud Environments
Description: Threat actors targeted misconfigured web applications used for security training and penetration testing (e.g., DVWA, OWASP Juice Shop, Hackazon, bWAPP) to infiltrate cloud environments of Fortune 500 companies and security vendors. Exposed instances on AWS, GCP, and Azure with overly permissive IAM roles allowed attackers to gain access to cloud storage, Secrets Manager, container registries, and admin control. Affected organizations included Cloudflare, F5, and Palo Alto Networks. Attackers deployed crypto miners, webshells, and established persistence mechanisms.
Type: Misconfiguration Exploitation
Attack Vector: Exposed insecure web applications (DVWA, OWASP Juice Shop, Hackazon, bWAPP)
Vulnerability Exploited: Overly permissive IAM roles, default credentials, lack of isolation between testing and production environments
Motivation: Financial gain (crypto mining)Persistence establishment
Title: DOGE Employees Alleged Election Interference and Data Misuse
Description: The U.S. Department of Justice (DOJ) revealed that members of Elon Musk’s 'DOGE' team at the Social Security Administration (SSA) engaged in undisclosed communications with an advocacy group to overturn election results, potentially violating federal privacy laws by matching Social Security data with state voter rolls. The incident also involved unauthorized use of third-party servers and unauthorized sharing of sensitive data.
Date Publicly Disclosed: 2025-03-03
Type: Data Misuse, Election Interference, Unauthorized Data Access
Attack Vector: Insider Threat, Unauthorized Data Sharing
Vulnerability Exploited: Lack of access controls, Unauthorized third-party server usage
Threat Actor: DOGE team members (insiders), Unnamed advocacy group
Motivation: Political interference, Election fraud investigation
What are the most common types of attacks the company has faced ?
Common Attack Types: The most common types of attacks the company has faced is Cyber Attack.
How does the company identify the attack vectors used in incidents ?
Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Mobile applications, Compromised Salesloft Drift authentication tokens (likely via phishing or credential stuffing), Compromised IoT Devices (home routers, IP cameras, DVRs), Compromised OAuth tokens via Salesloft Drift integration, Misconfigured security training apps (DVWA, OWASP Juice Shop and etc.).
Impact of the Incidents
What was the impact of each incident ?
Incident : DDoS Attack CLO33326522
Systems Affected: Crypto Launchpad
Incident : Data Breach CLO619191123
Data Compromised: Login passwords, Authentication cookies
Systems Affected: Cloudflare serversmobile apps
Incident : DDoS, Hacktivism, Malware CLO420051124
Data Compromised: Sensitive user data
Systems Affected: Israeli websitesMobile alert apps
Operational Impact: Fake alerts sent, User trust compromised
Brand Reputation Impact: Potential loss of trust
Identity Theft Risk: High
Incident : DDoS CLO717042825
Operational Impact: threaten service availability and corporate stability across industries
Incident : Data Breach CLO453090325
Data Compromised: Customer business contact details (names, emails, phone numbers, locations), Salesforce case data (subject lines, body text with potential keys/secrets), Aws access keys, Snowflake access tokens, Zscaler product licensing/commercial information, Support case logs (may include tokens/passwords)
Systems Affected: Salesforce instances (via Salesloft Drift integration)Google Workspace accounts (limited to Drift-integrated emails)Cloudflare API tokens (104 identified, rotated)
Downtime: ['Salesloft Drift platform taken offline', 'Salesforce-Salesloft integrations paused']
Operational Impact: Forensic investigations across hundreds of organizationsCredential rotation campaignsDisruption of customer support workflows (Salesforce case management)Temporary loss of Drift chatbot functionality
Customer Complaints: ['Potential increase due to exposed sensitive data in support cases']
Brand Reputation Impact: High (affects trust in Salesforce ecosystem and third-party integrations)Public disclosures by major tech firms may amplify scrutiny
Legal Liabilities: Potential GDPR/CCPA violations for exposed PIIContractual breaches with customers
Identity Theft Risk: ['Moderate (business contact details exposed)', 'Low for direct financial fraud (no payment data confirmed)']
Payment Information Risk: None reported
Incident : DDoS Attack CLO0692506101325
Systems Affected: Online Gaming Platforms (e.g., Minecraft)ISPs (AT&T, Comcast, Verizon, T-Mobile, Charter)
Downtime: Few seconds (but widespread disruption)
Operational Impact: Temporary disruption of major online gaming platforms and broader Internet services
Incident : Ransomware AMACLOCHA1767712395
Financial Loss: $3.09 billion
Data Compromised: Personal and medical data of 190 million individuals
Systems Affected: Healthcare transaction processing systems
Operational Impact: Disrupted nearly one-third of US patient records; delayed claims totaling $14 billion
Revenue Loss: 80% of affected clinicians experienced revenue losses
Identity Theft Risk: High
Incident : Supply Chain Attack SALCLO1768392789
Data Compromised: Business contact information (names, email addresses, job titles, phone numbers, regional/location details), product licensing and commercial information, plain text content from support cases (including logs, tokens, passwords), Salesforce Object Query Language (SOQL) queries, attachments/files/images in some cases
Systems Affected: Salesforce CRM platform (Account, Contact, Case, Opportunity objects)
Operational Impact: Potential phishing/smishing/vishing campaigns using exfiltrated data, credential rotation requirements, audit and remediation efforts
Brand Reputation Impact: Erosion of trust due to third-party integration failure, particularly for vendors in the SASE space
Identity Theft Risk: High (exfiltrated PII and credentials)
Incident : Zero-Day Vulnerability CLO1768841812
Data Compromised: Database credentials, API tokens, cloud keys, server-side rendering data, local file inclusion vulnerabilities
Systems Affected: Origin servers protected by Cloudflare WAF
Operational Impact: Potential unauthorized access to origin servers, bypass of WAF rules
Incident : Misconfiguration Exploitation CLOF5PAL1769009143
Systems Affected: Cloud storage (S3, GCS, Azure Blob)Secrets ManagerContainer registriesAdmin-controlled environments
Operational Impact: Deployment of crypto miners and webshells, remote command execution
Brand Reputation Impact: Potential reputational damage to affected security vendors
Incident : Data Misuse, Election Interference, Unauthorized Data Access CLOUSDSSA1769016836
Data Compromised: Social Security data, Voter rolls, Private data of ~1,000 individuals
Systems Affected: SSA systems, Third-party servers (Cloudflare)
Operational Impact: Potential legal and regulatory scrutiny, Reputational damage to SSA
Brand Reputation Impact: High (SSA and DOGE team)
Legal Liabilities: Potential Hatch Act violations, Privacy law violations
Identity Theft Risk: High (exposure of private data)
What is the average financial loss per incident ?
Average Financial Loss: The average financial loss per incident is $257.50 million.
What types of data are most commonly compromised in incidents ?
Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Login Passwords, Authentication Cookies, , Sensitive user data, Business Contact Information, Salesforce Case Metadata/Content, Authentication Tokens (Aws, Snowflake, Api Keys), Support Logs (May Include Sensitive Customer-Provided Data), , Personal Data, Medical Records, Health Insurance Info, , Business Contact Information, Support Case Data (Logs, Tokens, Passwords), Product Licensing And Commercial Information, Soql Queries, Attachments/Files/Images, , Database Credentials, Api Tokens, Cloud Keys, Server-Side Rendering Data, , Social Security data, Voter rolls and Personally identifiable information (PII).
Which entities were affected by each incident ?
Incident : DDoS Attack CLO33326522
Entity Name: Cloudflare
Entity Type: Company
Industry: Internet Infrastructure
Incident : Data Breach CLO619191123
Entity Name: Fitbit
Entity Type: Company
Industry: Health & Fitness
Incident : DDoS, Hacktivism, Malware CLO420051124
Entity Name: Cloudflare
Entity Type: Technology Company
Industry: Cybersecurity
Location: Global
Customers Affected: Israeli civilians
Incident : Data Breach CLO453090325
Entity Name: Cloudflare
Entity Type: Internet Infrastructure Company
Industry: Cybersecurity/Cloud Services
Location: San Francisco, CA, USA
Size: ~3,000 employees (2024)
Customers Affected: Limited subset (those with data in Salesforce cases)
Incident : Data Breach CLO453090325
Entity Name: Zscaler
Entity Type: Cybersecurity Firm
Industry: Cloud Security
Location: San Jose, CA, USA
Size: ~5,000 employees (2024)
Customers Affected: Customers with support cases or licensing data exposed
Incident : Data Breach CLO453090325
Entity Name: Palo Alto Networks
Entity Type: Cybersecurity Firm
Industry: Network Security
Location: Santa Clara, CA, USA
Size: ~12,000 employees (2024)
Customers Affected: Limited number with sensitive data in Salesforce
Incident : Data Breach CLO453090325
Entity Name: Salesloft
Entity Type: Sales Engagement Platform
Industry: SaaS/CRM
Location: Atlanta, GA, USA
Size: ~1,000 employees (2024)
Customers Affected: Hundreds of organizations using Drift-Salesforce integration
Incident : Data Breach CLO453090325
Entity Name: Google (Workspace)
Entity Type: Tech Giant
Industry: Cloud/Enterprise Software
Location: Mountain View, CA, USA
Size: ~190,000 employees (2024)
Customers Affected: Workspace administrators with Drift-integrated accounts
Incident : Data Breach CLO453090325
Entity Name: Over 700 Unnamed Companies
Entity Type: Varied (B2B organizations)
Industry: Multiple (tech, finance, healthcare, etc.)
Location: Global
Incident : DDoS Attack CLO0692506101325
Entity Name: AT&T
Entity Type: ISP
Industry: Telecommunications
Location: United States
Incident : DDoS Attack CLO0692506101325
Entity Name: Comcast
Entity Type: ISP
Industry: Telecommunications
Location: United States
Incident : DDoS Attack CLO0692506101325
Entity Name: Verizon
Entity Type: ISP
Industry: Telecommunications
Location: United States
Incident : DDoS Attack CLO0692506101325
Entity Name: T-Mobile
Entity Type: ISP
Industry: Telecommunications
Location: United States
Incident : DDoS Attack CLO0692506101325
Entity Name: Charter
Entity Type: ISP
Industry: Telecommunications
Location: United States
Incident : DDoS Attack CLO0692506101325
Entity Name: Minecraft (and other online gaming platforms)
Entity Type: Gaming Platform
Industry: Gaming/Entertainment
Location: Global
Incident : Ransomware AMACLOCHA1767712395
Entity Name: Change Healthcare
Entity Type: Healthcare
Industry: Healthcare
Location: United States
Customers Affected: 190 million individuals
Incident : Supply Chain Attack SALCLO1768392789
Entity Name: Palo Alto Networks
Entity Type: Enterprise
Industry: Cybersecurity
Customers Affected: Business contact information, internal sales account and case data
Incident : Supply Chain Attack SALCLO1768392789
Entity Name: Zscaler
Entity Type: Enterprise
Industry: Cybersecurity
Customers Affected: Business contact information, product licensing and commercial information, support case data
Incident : Supply Chain Attack SALCLO1768392789
Entity Name: Cloudflare
Entity Type: Enterprise
Industry: Cybersecurity/Network Services
Customers Affected: Business contact information, support case data (including logs, tokens, passwords)
Incident : Zero-Day Vulnerability CLO1768841812
Entity Name: Cloudflare
Entity Type: Cybersecurity Provider
Industry: Technology/Cloud Services
Customers Affected: All Cloudflare WAF customers
Incident : Misconfiguration Exploitation CLOF5PAL1769009143
Entity Name: Cloudflare
Entity Type: Security Vendor
Industry: Cybersecurity
Size: Large
Incident : Misconfiguration Exploitation CLOF5PAL1769009143
Entity Name: F5
Entity Type: Security Vendor
Industry: Cybersecurity
Size: Large
Incident : Misconfiguration Exploitation CLOF5PAL1769009143
Entity Name: Palo Alto Networks
Entity Type: Security Vendor
Industry: Cybersecurity
Size: Large
Incident : Misconfiguration Exploitation CLOF5PAL1769009143
Entity Name: Fortune 500 Companies
Entity Type: Enterprise
Industry: Various
Size: Large
Incident : Data Misuse, Election Interference, Unauthorized Data Access CLOUSDSSA1769016836
Entity Name: Social Security Administration (SSA)
Entity Type: Government Agency
Industry: Public Sector
Location: United States
Size: Large
Customers Affected: ~1,000 individuals
Response to the Incidents
What measures were taken in response to each incident ?
Incident : Data Breach CLO453090325
Incident Response Plan Activated: ['Cloudflare (August 23)', 'Zscaler', 'Palo Alto Networks', 'Salesloft', 'Google']
Third Party Assistance: Mandiant (For Salesloft Investigation), Google Threat Intelligence.
Containment Measures: Salesloft revoked all Drift-to-Salesforce connections (pre-notification)Cloudflare disabled Drift user accounts and purged Salesloft softwareGoogle revoked compromised Workspace tokens and disabled Drift integrationSalesloft took Drift platform offline and paused Salesforce integrations
Remediation Measures: Credential rotation (Cloudflare rotated 104 API tokens)Customer notifications via email/dashboard banners (Cloudflare, Palo Alto Networks)Forensic investigations across affected organizationsSalesforce instance audits for unauthorized access
Recovery Measures: Re-establishing secure integrations (timeline unclear)Enhanced monitoring of Salesforce/Salesloft environments
Communication Strategy: Public blog posts by Cloudflare, Zscaler, Palo Alto NetworksCustomer advisories with actionable steps (e.g., disconnect Salesloft, rotate credentials)Google’s updated threat advisory (August 2024)
Enhanced Monitoring: Likely implemented by affected companies (not detailed)
Incident : Supply Chain Attack SALCLO1768392789
Containment Measures: Rotation of credentials, review of Salesforce login history and audit trails, revocation of unused OAuth tokens, enforcement of token expiration
Remediation Measures: Strengthening SaaS environments and toolchain security, periodic review of third-party contracts for security language, enhanced monitoring of API access logs
Communication Strategy: Public disclosures via blogs and statements, customer advisories to rotate credentials, transparency about incident details and responsibility
Enhanced Monitoring: Review of Salesforce Event Monitoring logs, hunting for suspicious login attempts and unusual data access patterns, monitoring for Python/3.11 aiohttp/3.12.15 user agent string and known threat actor IP addresses
Incident : Zero-Day Vulnerability CLO1768841812
Third Party Assistance: FearsOff (security researchers)
Containment Measures: Permanent fix deployed to ensure WAF rules apply uniformly to all paths
Remediation Measures: Cloudflare validated and triaged the issue, deploying a fix on October 27, 2025
Communication Strategy: Public disclosure via HackerOne and company statement
Incident : Misconfiguration Exploitation CLOF5PAL1769009143
Third Party Assistance: Pentera (automated penetration testing firm)
Containment Measures: Remediation of misconfigurations by affected organizations
Remediation Measures: Inventory of cloud resourcesEnforcement of strict IAM policiesAutomatic expiration of temporary assets
Incident : Data Misuse, Election Interference, Unauthorized Data Access CLOUSDSSA1769016836
Law Enforcement Notified: Yes (DOJ investigation)
What is the company's incident response plan?
Incident Response Plan: The company's incident response plan is described as Cloudflare (August 23), Zscaler, Palo Alto Networks, Salesloft, Google, .
How does the company involve third-party assistance in incident response ?
Third-Party Assistance: The company involves third-party assistance in incident response through Mandiant (for Salesloft investigation), Google Threat Intelligence, , FearsOff (security researchers), Pentera (automated penetration testing firm).
Data Breach Information
What type of data was compromised in each breach ?
Incident : Data Breach CLO619191123
Type of Data Compromised: Login passwords, Authentication cookies
Incident : DDoS, Hacktivism, Malware CLO420051124
Type of Data Compromised: Sensitive user data
Sensitivity of Data: High
Personally Identifiable Information: Yes
Incident : Data Breach CLO453090325
Type of Data Compromised: Business contact information, Salesforce case metadata/content, Authentication tokens (aws, snowflake, api keys), Support logs (may include sensitive customer-provided data)
Number of Records Exposed: Exact count unknown; hundreds of organizations affected, Cloudflare identified 104 API tokens
Sensitivity of Data: Moderate to High (credentials/secrets in support cases)Low for most business contact details
Data Exfiltration: Confirmed between August 12–17, 2024Systematic export of large data volumes
File Types Exposed: Salesforce case records (text)CSV/JSON exports (likely)Email content (Google Workspace)
Personally Identifiable Information: Business emails, phone numbers, company names (no SSNs/financial data confirmed)
Incident : Ransomware AMACLOCHA1767712395
Type of Data Compromised: Personal data, Medical records, Health insurance info
Number of Records Exposed: 190 million
Sensitivity of Data: High
Data Encryption: Yes
Personally Identifiable Information: Names, DOB, addresses, SSNs, medical records, insurance IDs
Incident : Supply Chain Attack SALCLO1768392789
Type of Data Compromised: Business contact information, Support case data (logs, tokens, passwords), Product licensing and commercial information, Soql queries, Attachments/files/images
Sensitivity of Data: High (credentials, PII, internal business data)
File Types Exposed: Plain textAttachmentsImagesLogs
Incident : Zero-Day Vulnerability CLO1768841812
Type of Data Compromised: Database credentials, Api tokens, Cloud keys, Server-side rendering data
Sensitivity of Data: High
Incident : Misconfiguration Exploitation CLOF5PAL1769009143
Data Encryption: AES-256-encrypted tools observed in some instances
Incident : Data Misuse, Election Interference, Unauthorized Data Access CLOUSDSSA1769016836
Type of Data Compromised: Social Security data, Voter rolls, Personally identifiable information (PII)
Number of Records Exposed: ~1,000
Sensitivity of Data: High
Data Encryption: Password-protected file
Personally Identifiable Information: Yes
What measures does the company take to prevent data exfiltration ?
Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Credential rotation (Cloudflare rotated 104 API tokens), Customer notifications via email/dashboard banners (Cloudflare, Palo Alto Networks), Forensic investigations across affected organizations, Salesforce instance audits for unauthorized access, , Strengthening SaaS environments and toolchain security, periodic review of third-party contracts for security language, enhanced monitoring of API access logs, Cloudflare validated and triaged the issue, deploying a fix on October 27, 2025, Inventory of cloud resources, Enforcement of strict IAM policies, Automatic expiration of temporary assets, .
How does the company handle incidents involving personally identifiable information (PII) ?
Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by salesloft revoked all drift-to-salesforce connections (pre-notification), cloudflare disabled drift user accounts and purged salesloft software, google revoked compromised workspace tokens and disabled drift integration, salesloft took drift platform offline and paused salesforce integrations, , rotation of credentials, review of salesforce login history and audit trails, revocation of unused oauth tokens, enforcement of token expiration, permanent fix deployed to ensure waf rules apply uniformly to all paths and remediation of misconfigurations by affected organizations.
Ransomware Information
Was ransomware involved in any of the incidents ?
Incident : Ransomware CLO1006052925
Ransomware Strain: BlackSuitRoyalAkiraScattered SpiderMedusa
Incident : Data Breach CLO453090325
Data Exfiltration: Yes (but not ransomware-related)
Incident : Supply Chain Attack SALCLO1768392789
Data Exfiltration: True
How does the company recover data encrypted by ransomware ?
Data Recovery from Ransomware: The company recovers data encrypted by ransomware through Re-establishing secure integrations (timeline unclear), Enhanced monitoring of Salesforce/Salesloft environments, .
Regulatory Compliance
Were there any regulatory violations and fines imposed for each incident ?
Incident : Data Breach CLO453090325
Regulations Violated: Potential GDPR (EU customer data), CCPA (California residents), Industry-specific compliance (e.g., SOC 2),
Regulatory Notifications: Likely ongoing (not publicly detailed)
Incident : Ransomware AMACLOCHA1767712395
Fines Imposed: $96.9 million (related to another incident)
Incident : Data Misuse, Election Interference, Unauthorized Data Access CLOUSDSSA1769016836
Regulations Violated: Hatch Act, Federal privacy laws,
Legal Actions: Potential (DOJ investigation ongoing)
How does the company ensure compliance with regulatory requirements ?
Ensuring Regulatory Compliance: The company ensures compliance with regulatory requirements through Potential (DOJ investigation ongoing).
Lessons Learned and Recommendations
What lessons were learned from each incident ?
Incident : DDoS, Hacktivism, Malware CLO420051124
Lessons Learned: The importance of monitoring and mitigating cyber threats during times of conflict, especially when physical and cybersecurity domains intersect.
Incident : Ransomware CLO1006052925
Lessons Learned: The legitimate nature of Cloudflared traffic makes detection particularly challenging for security teams who must differentiate between authorized administrative use and malicious exploitation.
Incident : Data Breach CLO453090325
Lessons Learned: Third-party SaaS integrations introduce significant supply chain risk, especially when connected to core systems like Salesforce., Authentication tokens in chatbot/automation platforms (e.g., Drift) require stricter access controls and rotation policies., Over-permissive API integrations can enable large-scale data exfiltration with minimal detection., Proactive disconnection of integrations (as done by Salesloft) can limit blast radius, but transparency is critical to maintain trust., Credential hygiene (e.g., rotating tokens in support systems) is often overlooked but critical for limiting post-breach impact.
Incident : Supply Chain Attack SALCLO1768392789
Lessons Learned: Third-party integrations pose significant supply chain risks, OAuth tokens must be treated with the same security as passwords, zero trust principles (e.g., token expiration, periodic revocation) are critical, API security and monitoring must be prioritized, transparency and accountability in incident response build trust.
Incident : Zero-Day Vulnerability CLO1768841812
Lessons Learned: Improper handling of ACME HTTP-01 challenge paths can create unintended bypass vectors in WAF systems. Regular audits of edge network logic are necessary to prevent similar vulnerabilities.
Incident : Misconfiguration Exploitation CLOF5PAL1769009143
Lessons Learned: Organizations must inventory all cloud resources, enforce least-privilege IAM policies, and automatically expire temporary assets to mitigate risks from misconfigured non-production systems.
What recommendations were made to prevent future incidents ?
Incident : DDoS, Hacktivism, Malware CLO420051124
Recommendations: Enhance monitoring and mitigation strategies, improve communication and coordination with affected organizations, and increase public awareness about the risks of malicious mobile applications.
Incident : Data Breach CLO453090325
Recommendations: Audit all third-party integrations with Salesforce/CRM systems for least-privilege access., Isolate high-risk integrations (e.g., AI chatbots) in segmented network zones with enhanced logging., Implement automated token rotation for all API keys/secrets stored in SaaS platforms., Monitor for unusual data export patterns in Salesforce (e.g., bulk API calls)., Require multi-factor authentication (MFA) for all Salesforce integrations, including third-party tools., Conduct tabletop exercises for supply chain attack scenarios involving CRM/ERP systems., Evaluate the necessity of storing sensitive data (e.g., AWS keys) in customer support systems.Audit all third-party integrations with Salesforce/CRM systems for least-privilege access., Isolate high-risk integrations (e.g., AI chatbots) in segmented network zones with enhanced logging., Implement automated token rotation for all API keys/secrets stored in SaaS platforms., Monitor for unusual data export patterns in Salesforce (e.g., bulk API calls)., Require multi-factor authentication (MFA) for all Salesforce integrations, including third-party tools., Conduct tabletop exercises for supply chain attack scenarios involving CRM/ERP systems., Evaluate the necessity of storing sensitive data (e.g., AWS keys) in customer support systems.Audit all third-party integrations with Salesforce/CRM systems for least-privilege access., Isolate high-risk integrations (e.g., AI chatbots) in segmented network zones with enhanced logging., Implement automated token rotation for all API keys/secrets stored in SaaS platforms., Monitor for unusual data export patterns in Salesforce (e.g., bulk API calls)., Require multi-factor authentication (MFA) for all Salesforce integrations, including third-party tools., Conduct tabletop exercises for supply chain attack scenarios involving CRM/ERP systems., Evaluate the necessity of storing sensitive data (e.g., AWS keys) in customer support systems.Audit all third-party integrations with Salesforce/CRM systems for least-privilege access., Isolate high-risk integrations (e.g., AI chatbots) in segmented network zones with enhanced logging., Implement automated token rotation for all API keys/secrets stored in SaaS platforms., Monitor for unusual data export patterns in Salesforce (e.g., bulk API calls)., Require multi-factor authentication (MFA) for all Salesforce integrations, including third-party tools., Conduct tabletop exercises for supply chain attack scenarios involving CRM/ERP systems., Evaluate the necessity of storing sensitive data (e.g., AWS keys) in customer support systems.Audit all third-party integrations with Salesforce/CRM systems for least-privilege access., Isolate high-risk integrations (e.g., AI chatbots) in segmented network zones with enhanced logging., Implement automated token rotation for all API keys/secrets stored in SaaS platforms., Monitor for unusual data export patterns in Salesforce (e.g., bulk API calls)., Require multi-factor authentication (MFA) for all Salesforce integrations, including third-party tools., Conduct tabletop exercises for supply chain attack scenarios involving CRM/ERP systems., Evaluate the necessity of storing sensitive data (e.g., AWS keys) in customer support systems.Audit all third-party integrations with Salesforce/CRM systems for least-privilege access., Isolate high-risk integrations (e.g., AI chatbots) in segmented network zones with enhanced logging., Implement automated token rotation for all API keys/secrets stored in SaaS platforms., Monitor for unusual data export patterns in Salesforce (e.g., bulk API calls)., Require multi-factor authentication (MFA) for all Salesforce integrations, including third-party tools., Conduct tabletop exercises for supply chain attack scenarios involving CRM/ERP systems., Evaluate the necessity of storing sensitive data (e.g., AWS keys) in customer support systems.Audit all third-party integrations with Salesforce/CRM systems for least-privilege access., Isolate high-risk integrations (e.g., AI chatbots) in segmented network zones with enhanced logging., Implement automated token rotation for all API keys/secrets stored in SaaS platforms., Monitor for unusual data export patterns in Salesforce (e.g., bulk API calls)., Require multi-factor authentication (MFA) for all Salesforce integrations, including third-party tools., Conduct tabletop exercises for supply chain attack scenarios involving CRM/ERP systems., Evaluate the necessity of storing sensitive data (e.g., AWS keys) in customer support systems.
Incident : Supply Chain Attack SALCLO1768392789
Recommendations: Conduct thorough reviews of Salesforce login history, audit trails, and API access logs for unusual activity., Rotate credentials and revoke unused OAuth tokens., Enforce token expiration and periodic token refreshes., Strengthen SaaS environments and toolchain security., Periodically revisit third-party contracts to include security language (breach notification, right to audit, data handling, sub-processor transparency)., Enhance monitoring of API calls and SOQL queries for suspicious patterns., Adopt a zero trust mindset for third-party applications and SaaS., Educate employees on the risks of storing sensitive data in insecure fields (e.g., support case notes).Conduct thorough reviews of Salesforce login history, audit trails, and API access logs for unusual activity., Rotate credentials and revoke unused OAuth tokens., Enforce token expiration and periodic token refreshes., Strengthen SaaS environments and toolchain security., Periodically revisit third-party contracts to include security language (breach notification, right to audit, data handling, sub-processor transparency)., Enhance monitoring of API calls and SOQL queries for suspicious patterns., Adopt a zero trust mindset for third-party applications and SaaS., Educate employees on the risks of storing sensitive data in insecure fields (e.g., support case notes).Conduct thorough reviews of Salesforce login history, audit trails, and API access logs for unusual activity., Rotate credentials and revoke unused OAuth tokens., Enforce token expiration and periodic token refreshes., Strengthen SaaS environments and toolchain security., Periodically revisit third-party contracts to include security language (breach notification, right to audit, data handling, sub-processor transparency)., Enhance monitoring of API calls and SOQL queries for suspicious patterns., Adopt a zero trust mindset for third-party applications and SaaS., Educate employees on the risks of storing sensitive data in insecure fields (e.g., support case notes).Conduct thorough reviews of Salesforce login history, audit trails, and API access logs for unusual activity., Rotate credentials and revoke unused OAuth tokens., Enforce token expiration and periodic token refreshes., Strengthen SaaS environments and toolchain security., Periodically revisit third-party contracts to include security language (breach notification, right to audit, data handling, sub-processor transparency)., Enhance monitoring of API calls and SOQL queries for suspicious patterns., Adopt a zero trust mindset for third-party applications and SaaS., Educate employees on the risks of storing sensitive data in insecure fields (e.g., support case notes).Conduct thorough reviews of Salesforce login history, audit trails, and API access logs for unusual activity., Rotate credentials and revoke unused OAuth tokens., Enforce token expiration and periodic token refreshes., Strengthen SaaS environments and toolchain security., Periodically revisit third-party contracts to include security language (breach notification, right to audit, data handling, sub-processor transparency)., Enhance monitoring of API calls and SOQL queries for suspicious patterns., Adopt a zero trust mindset for third-party applications and SaaS., Educate employees on the risks of storing sensitive data in insecure fields (e.g., support case notes).Conduct thorough reviews of Salesforce login history, audit trails, and API access logs for unusual activity., Rotate credentials and revoke unused OAuth tokens., Enforce token expiration and periodic token refreshes., Strengthen SaaS environments and toolchain security., Periodically revisit third-party contracts to include security language (breach notification, right to audit, data handling, sub-processor transparency)., Enhance monitoring of API calls and SOQL queries for suspicious patterns., Adopt a zero trust mindset for third-party applications and SaaS., Educate employees on the risks of storing sensitive data in insecure fields (e.g., support case notes).Conduct thorough reviews of Salesforce login history, audit trails, and API access logs for unusual activity., Rotate credentials and revoke unused OAuth tokens., Enforce token expiration and periodic token refreshes., Strengthen SaaS environments and toolchain security., Periodically revisit third-party contracts to include security language (breach notification, right to audit, data handling, sub-processor transparency)., Enhance monitoring of API calls and SOQL queries for suspicious patterns., Adopt a zero trust mindset for third-party applications and SaaS., Educate employees on the risks of storing sensitive data in insecure fields (e.g., support case notes).Conduct thorough reviews of Salesforce login history, audit trails, and API access logs for unusual activity., Rotate credentials and revoke unused OAuth tokens., Enforce token expiration and periodic token refreshes., Strengthen SaaS environments and toolchain security., Periodically revisit third-party contracts to include security language (breach notification, right to audit, data handling, sub-processor transparency)., Enhance monitoring of API calls and SOQL queries for suspicious patterns., Adopt a zero trust mindset for third-party applications and SaaS., Educate employees on the risks of storing sensitive data in insecure fields (e.g., support case notes).
Incident : Zero-Day Vulnerability CLO1768841812
Recommendations: Cloudflare customers were advised that no action was required post-fix. Organizations should verify WAF rule consistency across all paths, including ACME challenge directories.
Incident : Misconfiguration Exploitation CLOF5PAL1769009143
Recommendations: Inventory all cloud resources, Enforce strict IAM policies, Automatically expire temporary assets, Isolate testing and production environmentsInventory all cloud resources, Enforce strict IAM policies, Automatically expire temporary assets, Isolate testing and production environmentsInventory all cloud resources, Enforce strict IAM policies, Automatically expire temporary assets, Isolate testing and production environmentsInventory all cloud resources, Enforce strict IAM policies, Automatically expire temporary assets, Isolate testing and production environments
What are the key lessons learned from past incidents ?
Key Lessons Learned: The key lessons learned from past incidents are The importance of monitoring and mitigating cyber threats during times of conflict, especially when physical and cybersecurity domains intersect.The legitimate nature of Cloudflared traffic makes detection particularly challenging for security teams who must differentiate between authorized administrative use and malicious exploitation.Third-party SaaS integrations introduce significant supply chain risk, especially when connected to core systems like Salesforce.,Authentication tokens in chatbot/automation platforms (e.g., Drift) require stricter access controls and rotation policies.,Over-permissive API integrations can enable large-scale data exfiltration with minimal detection.,Proactive disconnection of integrations (as done by Salesloft) can limit blast radius, but transparency is critical to maintain trust.,Credential hygiene (e.g., rotating tokens in support systems) is often overlooked but critical for limiting post-breach impact.Third-party integrations pose significant supply chain risks, OAuth tokens must be treated with the same security as passwords, zero trust principles (e.g., token expiration, periodic revocation) are critical, API security and monitoring must be prioritized, transparency and accountability in incident response build trust.Improper handling of ACME HTTP-01 challenge paths can create unintended bypass vectors in WAF systems. Regular audits of edge network logic are necessary to prevent similar vulnerabilities.Organizations must inventory all cloud resources, enforce least-privilege IAM policies, and automatically expire temporary assets to mitigate risks from misconfigured non-production systems.
What recommendations has the company implemented to improve cybersecurity ?
Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Strengthen SaaS environments and toolchain security., Enhance monitoring and mitigation strategies, improve communication and coordination with affected organizations, and increase public awareness about the risks of malicious mobile applications., Periodically revisit third-party contracts to include security language (breach notification, right to audit, data handling, sub-processor transparency)., Adopt a zero trust mindset for third-party applications and SaaS., Cloudflare customers were advised that no action was required post-fix. Organizations should verify WAF rule consistency across all paths, including ACME challenge directories., Educate employees on the risks of storing sensitive data in insecure fields (e.g., support case notes)., Rotate credentials and revoke unused OAuth tokens., Enforce token expiration and periodic token refreshes., Conduct thorough reviews of Salesforce login history, audit trails, and API access logs for unusual activity. and Enhance monitoring of API calls and SOQL queries for suspicious patterns..
References
Where can I find more information about each incident ?
Incident : DDoS, Hacktivism, Malware CLO420051124
Source: Cloudflare
Incident : Ransomware CLO1006052925
Source: Sudo Rem
Incident : Data Breach CLO453090325
Source: CyberScoop
URL: https://www.cyberscoop.com/salesforce-salesloft-drift-hack-cloudflare-zscaler-palo-alto/
Date Accessed: 2024-08-28
Incident : Data Breach CLO453090325
Source: Cloudflare Blog (Postmortem)
URL: https://blog.cloudflare.com/salesloft-drift-incident-august-2024
Date Accessed: 2024-08-27
Incident : Data Breach CLO453090325
Source: Zscaler Advisory
URL: https://www.zscaler.com/blogs/security-advisories/salesloft-drift-incident-update
Date Accessed: 2024-08-26
Incident : Data Breach CLO453090325
Source: Palo Alto Networks Statement
URL: https://www.paloaltonetworks.com/blog/2024/08/salesloft-drift-incident-response/
Date Accessed: 2024-08-27
Incident : Data Breach CLO453090325
Source: Google Threat Intelligence Advisory
Date Accessed: 2024-08-25
Incident : Data Breach CLO453090325
Source: Mandiant (UNC6395 Tracking)
URL: https://www.mandiant.com/resources/insights/unc6395-salesforce-campaign
Date Accessed: 2024-08-20
Incident : DDoS Attack CLO0692506101325
Source: Krebs on Security (Brian Krebs)
Incident : Ransomware AMACLOCHA1767712395
Source: DemandSage
Incident : Supply Chain Attack SALCLO1768392789
Source: Cloudflare Blog
Incident : Supply Chain Attack SALCLO1768392789
Source: Palo Alto Networks Unit 42 Threat Brief
Incident : Supply Chain Attack SALCLO1768392789
Source: Zscaler Statement
Incident : Supply Chain Attack SALCLO1768392789
Source: Evan Schuman (CSO Online)
Incident : Zero-Day Vulnerability CLO1768841812
Source: FearsOff Research
Incident : Zero-Day Vulnerability CLO1768841812
Source: Cloudflare HackerOne Report
Incident : Misconfiguration Exploitation CLOF5PAL1769009143
Source: Pentera Investigation
Incident : Data Misuse, Election Interference, Unauthorized Data Access CLOUSDSSA1769016836
Source: U.S. Department of Justice (DOJ) court filing
Where can stakeholders find additional resources on cybersecurity best practices ?
Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Cloudflare, and Source: Sudo Rem, and Source: CyberScoopUrl: https://www.cyberscoop.com/salesforce-salesloft-drift-hack-cloudflare-zscaler-palo-alto/Date Accessed: 2024-08-28, and Source: Cloudflare Blog (Postmortem)Url: https://blog.cloudflare.com/salesloft-drift-incident-august-2024Date Accessed: 2024-08-27, and Source: Zscaler AdvisoryUrl: https://www.zscaler.com/blogs/security-advisories/salesloft-drift-incident-updateDate Accessed: 2024-08-26, and Source: Palo Alto Networks StatementUrl: https://www.paloaltonetworks.com/blog/2024/08/salesloft-drift-incident-response/Date Accessed: 2024-08-27, and Source: Google Threat Intelligence AdvisoryUrl: https://cloud.google.com/blog/products/identity-security/google-threat-intelligence-salesloft-drift-campaignDate Accessed: 2024-08-25, and Source: Mandiant (UNC6395 Tracking)Url: https://www.mandiant.com/resources/insights/unc6395-salesforce-campaignDate Accessed: 2024-08-20, and Source: Krebs on Security (Brian Krebs), and Source: DemandSage, and Source: Cloudflare Blog, and Source: Palo Alto Networks Unit 42 Threat Brief, and Source: Zscaler Statement, and Source: Evan Schuman (CSO Online), and Source: FearsOff Research, and Source: Cloudflare HackerOne Report, and Source: Pentera Investigation, and Source: U.S. Department of Justice (DOJ) court filing.
Investigation Status
What is the current status of the investigation for each incident ?
Incident : DDoS, Hacktivism, Malware CLO420051124
Investigation Status: Ongoing
Incident : Data Breach CLO453090325
Investigation Status: Ongoing (as of August 28, 2024)
Incident : Supply Chain Attack SALCLO1768392789
Investigation Status: Ongoing
Incident : Zero-Day Vulnerability CLO1768841812
Investigation Status: Resolved
Incident : Misconfiguration Exploitation CLOF5PAL1769009143
Investigation Status: Remediated by affected organizations
Incident : Data Misuse, Election Interference, Unauthorized Data Access CLOUSDSSA1769016836
Investigation Status: Ongoing
How does the company communicate the status of incident investigations to stakeholders ?
Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Blog Posts By Cloudflare, Zscaler, Palo Alto Networks, Customer Advisories With Actionable Steps (E.G., Disconnect Salesloft, Rotate Credentials), Google’S Updated Threat Advisory (August 2024), Public disclosures via blogs and statements, customer advisories to rotate credentials, transparency about incident details and responsibility and Public disclosure via HackerOne and company statement.
Stakeholder and Customer Advisories
Were there any advisories issued to stakeholders or customers for each incident ?
Incident : Data Breach CLO453090325
Stakeholder Advisories: Disconnect Salesloft Drift Integration Immediately., Treat All Drift-Stored Authentication Tokens As Compromised., Audit Salesforce For Unauthorized Data Exports (August 8–18, 2024)., Rotate All Credentials/Secrets Shared Via Salesforce Cases Or Drift Chats., Monitor For Follow-On Attacks Leveraging Stolen Aws/Snowflake Tokens..
Customer Advisories: Cloudflare: Notified affected customers via email/dashboard banners; urged credential rotation.Palo Alto Networks: Contacting customers with potentially exposed sensitive data.Zscaler: Published guidance for customers to review exposed support cases.Salesloft: Advises all customers to disconnect Drift-Salesforce integration.
Incident : Supply Chain Attack SALCLO1768392789
Stakeholder Advisories: Customers urged to rotate credentials, review Salesforce logs for suspicious activity, and treat any shared support case data as compromised.
Customer Advisories: Rotate credentials, monitor for phishing/smishing/vishing attacks using exfiltrated data, review Salesforce audit logs for unusual activity.
Incident : Zero-Day Vulnerability CLO1768841812
Stakeholder Advisories: Cloudflare confirmed no evidence of malicious exploitation and stated no customer action was required.
What advisories does the company provide to stakeholders and customers following an incident ?
Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Disconnect Salesloft Drift Integration Immediately., Treat All Drift-Stored Authentication Tokens As Compromised., Audit Salesforce For Unauthorized Data Exports (August 8–18, 2024)., Rotate All Credentials/Secrets Shared Via Salesforce Cases Or Drift Chats., Monitor For Follow-On Attacks Leveraging Stolen Aws/Snowflake Tokens., Cloudflare: Notified Affected Customers Via Email/Dashboard Banners; Urged Credential Rotation., Palo Alto Networks: Contacting Customers With Potentially Exposed Sensitive Data., Zscaler: Published Guidance For Customers To Review Exposed Support Cases., Salesloft: Advises All Customers To Disconnect Drift-Salesforce Integration., , Customers urged to rotate credentials, review Salesforce logs for suspicious activity, and treat any shared support case data as compromised., Rotate credentials, monitor for phishing/smishing/vishing attacks using exfiltrated data, review Salesforce audit logs for unusual activity. and Cloudflare confirmed no evidence of malicious exploitation and stated no customer action was required..
Initial Access Broker
How did the initial access broker gain entry for each incident ?
Incident : DDoS, Hacktivism, Malware CLO420051124
Entry Point: Mobile applications
High Value Targets: Critical alert systems
Data Sold on Dark Web: Critical alert systems
Incident : Data Breach CLO453090325
Entry Point: Compromised Salesloft Drift authentication tokens (likely via phishing or credential stuffing)
Reconnaissance Period: ['August 9, 2024 (Google observed email access)', 'Likely earlier for initial Drift compromise']
High Value Targets: Aws Access Keys, Snowflake Tokens, Salesforce Case Data With Secrets,
Data Sold on Dark Web: Aws Access Keys, Snowflake Tokens, Salesforce Case Data With Secrets,
Incident : DDoS Attack CLO0692506101325
Entry Point: Compromised Iot Devices (Home Routers, Ip Cameras, Dvrs),
High Value Targets: Isps Serving Online Gaming Communities,
Data Sold on Dark Web: Isps Serving Online Gaming Communities,
Incident : Supply Chain Attack SALCLO1768392789
Entry Point: Compromised OAuth tokens via Salesloft Drift integration
High Value Targets: Account, Contact, Case, Opportunity Records,
Data Sold on Dark Web: Account, Contact, Case, Opportunity Records,
Incident : Misconfiguration Exploitation CLOF5PAL1769009143
Entry Point: Misconfigured security training apps (DVWA, OWASP Juice Shop, etc.)
Backdoors Established: Webshells (e.g., filemanager.php), watchdog.sh script for persistence
High Value Targets: Cloud storage, Secrets Manager, container registries
Data Sold on Dark Web: Cloud storage, Secrets Manager, container registries
Post-Incident Analysis
What were the root causes and corrective actions taken for each incident ?
Incident : DDoS, Hacktivism, Malware CLO420051124
Root Causes: DDoS attacks and malicious mobile applications
Corrective Actions: Enhanced monitoring and mitigation strategies
Incident : Data Breach CLO453090325
Root Causes: Insufficient Access Controls For Drift-Salesforce Integration Tokens., Lack Of Network Segmentation Between Drift And Salesforce Data Stores., Over-Reliance On Static Api Tokens Without Rotation Policies., Delayed Detection Of Bulk Data Exfiltration (August 8–18 Activity Detected Later)., Acquisition-Related Security Gaps (Drift’S Integration Post-Salesloft Acquisition).,
Corrective Actions: Salesloft: Offlined Drift, Revoked All Integration Tokens, Mandatory Customer Disconnections., Cloudflare: Purged Salesloft Software, Rotated All Exposed Api Tokens, Enhanced Salesforce Logging., Google: Disabled Drift-Workspace Integration, Revoked Compromised Tokens., Industry-Wide: Reevaluation Of Third-Party Chatbot/Automation Tool Security Postures.,
Incident : DDoS Attack CLO0692506101325
Root Causes: Exploitation Of Vulnerable Iot Devices For Botnet Recruitment, Insufficient Ddos Mitigation Capabilities In Targeted Isps,
Incident : Supply Chain Attack SALCLO1768392789
Root Causes: Stolen or misconfigured OAuth tokens, insufficient monitoring of API access, lack of zero trust principles (e.g., token expiration), third-party integration risks
Corrective Actions: Strengthen SaaS security, enforce zero trust for third-party apps, enhance API monitoring, rotate credentials, revoke unused tokens, improve third-party contract security language
Incident : Zero-Day Vulnerability CLO1768841812
Root Causes: Logic error in Cloudflare’s edge network where ACME path requests with non-matching tokens bypassed WAF rules entirely.
Corrective Actions: Permanent fix deployed to ensure WAF rules apply uniformly to all paths, including ACME challenge directories.
Incident : Misconfiguration Exploitation CLOF5PAL1769009143
Root Causes: Public Exposure Of Testing Apps Meant For Internal Use, Overly Permissive Iam Roles, Default Or Unchanged Credentials, Lack Of Isolation Between Testing And Production Environments,
Corrective Actions: Remediation Of Misconfigurations, Enforcement Of Least-Privilege Iam Policies, Automatic Expiration Of Temporary Assets,
Incident : Data Misuse, Election Interference, Unauthorized Data Access CLOUSDSSA1769016836
Root Causes: Insider threat, Lack of oversight on data sharing, Unauthorized third-party server usage
What is the company's process for conducting post-incident analysis ?
Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Mandiant (For Salesloft Investigation), Google Threat Intelligence, , Likely Implemented By Affected Companies (Not Detailed), , Review of Salesforce Event Monitoring logs, hunting for suspicious login attempts and unusual data access patterns, monitoring for Python/3.11 aiohttp/3.12.15 user agent string and known threat actor IP addresses, FearsOff (security researchers), Pentera (automated penetration testing firm).
What corrective actions has the company taken based on post-incident analysis ?
Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Enhanced monitoring and mitigation strategies, Salesloft: Offlined Drift, Revoked All Integration Tokens, Mandatory Customer Disconnections., Cloudflare: Purged Salesloft Software, Rotated All Exposed Api Tokens, Enhanced Salesforce Logging., Google: Disabled Drift-Workspace Integration, Revoked Compromised Tokens., Industry-Wide: Reevaluation Of Third-Party Chatbot/Automation Tool Security Postures., , Strengthen SaaS security, enforce zero trust for third-party apps, enhance API monitoring, rotate credentials, revoke unused tokens, improve third-party contract security language, Permanent fix deployed to ensure WAF rules apply uniformly to all paths, including ACME challenge directories., Remediation Of Misconfigurations, Enforcement Of Least-Privilege Iam Policies, Automatic Expiration Of Temporary Assets, .
Additional Questions
General Information
Who was the attacking group in the last incident ?
Last Attacking Group: The attacking group in the last incident were an Pro-Palestinian hacktivist groups, BlackSuitRoyalAkiraScattered SpiderMedusaHunter International, UNC6395 (tracked by Mandiant), Aisuru IoT Botnet, BlackCat group, DOGE team members (insiders) and Unnamed advocacy group.
Incident Details
What was the most recent incident detected ?
Most Recent Incident Detected: The most recent incident detected was on 2023-10-07.
What was the most recent incident publicly disclosed ?
Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-03-03.
What was the most recent incident resolved ?
Most Recent Incident Resolved: The most recent incident resolved was on 2025-10-27.
Impact of the Incidents
What was the highest financial loss from an incident ?
Highest Financial Loss: The highest financial loss from an incident was $3.09 billion.
What was the most significant data compromised in an incident ?
Most Significant Data Compromised: The most significant data compromised in an incident were login passwords, authentication cookies, , Sensitive user data, Customer business contact details (names, emails, phone numbers, locations), Salesforce case data (subject lines, body text with potential keys/secrets), AWS access keys, Snowflake access tokens, Zscaler product licensing/commercial information, Support case logs (may include tokens/passwords), , Personal and medical data of 190 million individuals, Business contact information (names, email addresses, job titles, phone numbers, regional/location details), product licensing and commercial information, plain text content from support cases (including logs, tokens, passwords), Salesforce Object Query Language (SOQL) queries, attachments/files/images in some cases, Database credentials, API tokens, cloud keys, server-side rendering data, local file inclusion vulnerabilities, Social Security data, Voter rolls, Private data of ~1 and000 individuals.
What was the most significant system affected in an incident ?
Most Significant System Affected: The most significant system affected in an incident were Crypto Launchpad and Cloudflare serversmobile apps and Israeli websitesMobile alert apps and Salesforce instances (via Salesloft Drift integration)Google Workspace accounts (limited to Drift-integrated emails)Cloudflare API tokens (104 identified, rotated) and Online Gaming Platforms (e.g., Minecraft)ISPs (AT&T, Comcast, Verizon, T-Mobile, Charter) and and and and Cloud storage (S3, GCS, Azure Blob)Secrets ManagerContainer registriesAdmin-controlled environments and .
Response to the Incidents
What third-party assistance was involved in the most recent incident ?
Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was mandiant (for salesloft investigation), google threat intelligence, , FearsOff (security researchers), Pentera (automated penetration testing firm).
What containment measures were taken in the most recent incident ?
Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Salesloft revoked all Drift-to-Salesforce connections (pre-notification)Cloudflare disabled Drift user accounts and purged Salesloft softwareGoogle revoked compromised Workspace tokens and disabled Drift integrationSalesloft took Drift platform offline and paused Salesforce integrations, Rotation of credentials, review of Salesforce login history and audit trails, revocation of unused OAuth tokens, enforcement of token expiration, Permanent fix deployed to ensure WAF rules apply uniformly to all paths and Remediation of misconfigurations by affected organizations.
Data Breach Information
What was the most sensitive data compromised in a breach ?
Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Database credentials, API tokens, cloud keys, server-side rendering data, local file inclusion vulnerabilities, Support case logs (may include tokens/passwords), authentication cookies, AWS access keys, Customer business contact details (names, emails, phone numbers, locations), Zscaler product licensing/commercial information, Personal and medical data of 190 million individuals, Salesforce case data (subject lines, body text with potential keys/secrets), Business contact information (names, email addresses, job titles, phone numbers, regional/location details), product licensing and commercial information, plain text content from support cases (including logs, tokens, passwords), Salesforce Object Query Language (SOQL) queries, attachments/files/images in some cases, login passwords, Snowflake access tokens, Sensitive user data, Social Security data, Voter rolls, Private data of ~1 and000 individuals.
What was the number of records exposed in the most significant breach ?
Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 190.0M.
Regulatory Compliance
What was the highest fine imposed for a regulatory violation ?
Highest Fine Imposed: The highest fine imposed for a regulatory violation was $96.9 million (related to another incident).
What was the most significant legal action taken for a regulatory violation ?
Most Significant Legal Action: The most significant legal action taken for a regulatory violation was Potential (DOJ investigation ongoing).
Lessons Learned and Recommendations
What was the most significant lesson learned from past incidents ?
Most Significant Lesson Learned: The most significant lesson learned from past incidents was Credential hygiene (e.g., rotating tokens in support systems) is often overlooked but critical for limiting post-breach impact., Third-party integrations pose significant supply chain risks, OAuth tokens must be treated with the same security as passwords, zero trust principles (e.g., token expiration, periodic revocation) are critical, API security and monitoring must be prioritized, transparency and accountability in incident response build trust., Improper handling of ACME HTTP-01 challenge paths can create unintended bypass vectors in WAF systems. Regular audits of edge network logic are necessary to prevent similar vulnerabilities., Organizations must inventory all cloud resources, enforce least-privilege IAM policies, and automatically expire temporary assets to mitigate risks from misconfigured non-production systems.
What was the most significant recommendation implemented to improve cybersecurity ?
Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Implement automated token rotation for all API keys/secrets stored in SaaS platforms., Audit all third-party integrations with Salesforce/CRM systems for least-privilege access., Educate employees on the risks of storing sensitive data in insecure fields (e.g., support case notes)., Strengthen SaaS environments and toolchain security., Periodically revisit third-party contracts to include security language (breach notification, right to audit, data handling, sub-processor transparency)., Cloudflare customers were advised that no action was required post-fix. Organizations should verify WAF rule consistency across all paths, including ACME challenge directories., Monitor for unusual data export patterns in Salesforce (e.g., bulk API calls)., Evaluate the necessity of storing sensitive data (e.g., AWS keys) in customer support systems., Conduct tabletop exercises for supply chain attack scenarios involving CRM/ERP systems., Inventory all cloud resources, Enforce strict IAM policies, Automatically expire temporary assets, Enhance monitoring and mitigation strategies, improve communication and coordination with affected organizations, and increase public awareness about the risks of malicious mobile applications., Require multi-factor authentication (MFA) for all Salesforce integrations, including third-party tools., Adopt a zero trust mindset for third-party applications and SaaS., Isolate testing and production environments, Isolate high-risk integrations (e.g., AI chatbots) in segmented network zones with enhanced logging., Rotate credentials and revoke unused OAuth tokens., Enforce token expiration and periodic token refreshes., Conduct thorough reviews of Salesforce login history, audit trails, and API access logs for unusual activity. and Enhance monitoring of API calls and SOQL queries for suspicious patterns..
References
What is the most recent source of information about an incident ?
Most Recent Source: The most recent source of information about an incident are Google Threat Intelligence Advisory, DemandSage, Cloudflare Blog, U.S. Department of Justice (DOJ) court filing, Palo Alto Networks Statement, Cloudflare Blog (Postmortem), Cloudflare, Palo Alto Networks Unit 42 Threat Brief, CyberScoop, Sudo Rem, Mandiant (UNC6395 Tracking), Cloudflare HackerOne Report, Zscaler Statement, Evan Schuman (CSO Online), Zscaler Advisory, Krebs on Security (Brian Krebs), Pentera Investigation and FearsOff Research.
What is the most recent URL for additional resources on cybersecurity best practices ?
Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.cyberscoop.com/salesforce-salesloft-drift-hack-cloudflare-zscaler-palo-alto/, https://blog.cloudflare.com/salesloft-drift-incident-august-2024, https://www.zscaler.com/blogs/security-advisories/salesloft-drift-incident-update, https://www.paloaltonetworks.com/blog/2024/08/salesloft-drift-incident-response/, https://cloud.google.com/blog/products/identity-security/google-threat-intelligence-salesloft-drift-campaign, https://www.mandiant.com/resources/insights/unc6395-salesforce-campaign .
Investigation Status
What is the current status of the most recent investigation ?
Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing.
Stakeholder and Customer Advisories
What was the most recent stakeholder advisory issued ?
Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Disconnect Salesloft Drift integration immediately., Treat all Drift-stored authentication tokens as compromised., Audit Salesforce for unauthorized data exports (August 8–18, 2024)., Rotate all credentials/secrets shared via Salesforce cases or Drift chats., Monitor for follow-on attacks leveraging stolen AWS/Snowflake tokens., Customers urged to rotate credentials, review Salesforce logs for suspicious activity, and treat any shared support case data as compromised., Cloudflare confirmed no evidence of malicious exploitation and stated no customer action was required., .
What was the most recent customer advisory issued ?
Most Recent Customer Advisory: The most recent customer advisory issued were an Cloudflare: Notified affected customers via email/dashboard banners; urged credential rotation.Palo Alto Networks: Contacting customers with potentially exposed sensitive data.Zscaler: Published guidance for customers to review exposed support cases.Salesloft: Advises all customers to disconnect Drift-Salesforce integration., Rotate credentials, monitor for phishing/smishing/vishing attacks using exfiltrated data and review Salesforce audit logs for unusual activity.
Initial Access Broker
What was the most recent entry point used by an initial access broker ?
Most Recent Entry Point: The most recent entry point used by an initial access broker were an Misconfigured security training apps (DVWA, OWASP Juice Shop, etc.), Compromised OAuth tokens via Salesloft Drift integration, Compromised Salesloft Drift authentication tokens (likely via phishing or credential stuffing) and Mobile applications.
What was the most recent reconnaissance period for an incident ?
Most Recent Reconnaissance Period: The most recent reconnaissance period for an incident was August 9, 2024 (Google observed email access)Likely earlier for initial Drift compromise.
Post-Incident Analysis
What was the most significant root cause identified in post-incident analysis ?
Most Significant Root Cause: The most significant root cause identified in post-incident analysis was DDoS attacks and malicious mobile applications, Insufficient access controls for Drift-Salesforce integration tokens.Lack of network segmentation between Drift and Salesforce data stores.Over-reliance on static API tokens without rotation policies.Delayed detection of bulk data exfiltration (August 8–18 activity detected later).Acquisition-related security gaps (Drift’s integration post-Salesloft acquisition)., Exploitation of vulnerable IoT devices for botnet recruitmentInsufficient DDoS mitigation capabilities in targeted ISPs, Stolen or misconfigured OAuth tokens, insufficient monitoring of API access, lack of zero trust principles (e.g., token expiration), third-party integration risks, Logic error in Cloudflare’s edge network where ACME path requests with non-matching tokens bypassed WAF rules entirely., Public exposure of testing apps meant for internal useOverly permissive IAM rolesDefault or unchanged credentialsLack of isolation between testing and production environments, Insider threat, Lack of oversight on data sharing, Unauthorized third-party server usage.
What was the most significant corrective action taken based on post-incident analysis ?
Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Enhanced monitoring and mitigation strategies, Salesloft: Offlined Drift, revoked all integration tokens, mandatory customer disconnections.Cloudflare: Purged Salesloft software, rotated all exposed API tokens, enhanced Salesforce logging.Google: Disabled Drift-Workspace integration, revoked compromised tokens.Industry-wide: Reevaluation of third-party chatbot/automation tool security postures., Strengthen SaaS security, enforce zero trust for third-party apps, enhance API monitoring, rotate credentials, revoke unused tokens, improve third-party contract security language, Permanent fix deployed to ensure WAF rules apply uniformly to all paths, including ACME challenge directories., Remediation of misconfigurationsEnforcement of least-privilege IAM policiesAutomatic expiration of temporary assets.
.png)
Latest Global CVEs (Not Company-Specific)
Description
SummaryA command injection vulnerability (CWE-78) has been found to exist in the `wrangler pages deploy` command. The issue occurs because the `--commit-hash` parameter is passed directly to a shell command without proper validation or sanitization, allowing an attacker with control of `--commit-hash` to execute arbitrary commands on the system running Wrangler. Root causeThe commitHash variable, derived from user input via the --commit-hash CLI argument, is interpolated directly into a shell command using template literals (e.g., execSync(`git show -s --format=%B ${commitHash}`)). Shell metacharacters are interpreted by the shell, enabling command execution. ImpactThis vulnerability is generally hard to exploit, as it requires --commit-hash to be attacker controlled. The vulnerability primarily affects CI/CD environments where `wrangler pages deploy` is used in automated pipelines and the --commit-hash parameter is populated from external, potentially untrusted sources. An attacker could exploit this to: * Run any shell command. * Exfiltrate environment variables. * Compromise the CI runner to install backdoors or modify build artifacts. Credits Disclosed responsibly by kny4hacker. Mitigation * Wrangler v4 users are requested to upgrade to Wrangler v4.59.1 or higher. * Wrangler v3 users are requested to upgrade to Wrangler v3.114.17 or higher. * Users on Wrangler v2 (EOL) should upgrade to a supported major version.
Risk Information
cvss4
Base: 7.7
Severity: LOW
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Risk Information
cvss3
Base: 8.2
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in unauthorized creation, deletion or modification access to critical data or all Oracle VM VirtualBox accessible data as well as unauthorized access to critical data or complete access to all Oracle VM VirtualBox accessible data and unauthorized ability to cause a partial denial of service (partial DOS) of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.1 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L).
Risk Information
cvss3
Base: 8.1
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:L
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Risk Information
cvss3
Base: 8.2
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Description
Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). Supported versions that are affected are 7.1.14 and 7.2.4. Easily exploitable vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle VM VirtualBox. While the vulnerability is in Oracle VM VirtualBox, attacks may significantly impact additional products (scope change). Successful attacks of this vulnerability can result in takeover of Oracle VM VirtualBox. CVSS 3.1 Base Score 8.2 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).
Risk Information
cvss3
Base: 8.2
Severity: LOW
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Access Data Using Our API
Get company history
curl -i -X GET 'https://api.rankiteo.com/underwriter-getcompany-history?linkedin_id=cloudflare' -H 'apikey: YOUR_API_KEY_HERE'
RapidWhat Do We Measure ?
Incident
Finding
Grade
Digital Assets
Every week, Rankiteo analyzes billions of signals to give organizations a sharper, faster view of emerging risks. With deeper, more actionable intelligence at their fingertips, security teams can outpace threat actors, respond instantly to Zero-Day attacks, and dramatically shrink their risk exposure window.
These are some of the factors we use to calculate the overall score:
Network Security
Identify exposed access points, detect misconfigured SSL certificates, and uncover vulnerabilities across the network infrastructure.
SBOM (Software Bill of Materials)
Gain visibility into the software components used within an organization to detect vulnerabilities, manage risk, and ensure supply chain security.
CMDB (Configuration Management Database)
Monitor and manage all IT assets and their configurations to ensure accurate, real-time visibility across the company's technology environment.
Threat Intelligence
Leverage real-time insights on active threats, malware campaigns, and emerging vulnerabilities to proactively defend against evolving cyberattacks.
Rankiteo is a unified scoring and risk platform that analyzes billions of signals weekly to help organizations gain faster, more actionable insights into emerging threats. Empowering teams to outpace adversaries and reduce exposure.
