Workiva, a cloud-based SaaS provider specializing in financial reporting, compliance, and audits, suffered a supply chain attack via a compromised third-party CRM system (Salesforce). Threat actors (linked to the ShinyHunters extortion group) exfiltrated business contact data—including names, email addresses, phone numbers, and support ticket content—from affected customers. While Workiva’s core platform remained unbreached, the stolen data poses risks for spear-phishing attacks targeting high-profile clients (e.g., Google, T-Mobile, Delta Air Lines, Santander). The breach originated from unauthorized access via a connected third-party application (Salesloft’s Drift AI chat integration), part of a broader campaign exploiting OAuth tokens to extract sensitive credentials (e.g., AWS keys, Snowflake tokens) from Salesforce instances. Workiva warned customers to expect phishing attempts but confirmed no direct compromise of its financial or operational systems. The incident aligns with a wider wave of Salesforce breaches impacting cybersecurity firms and Fortune 500 companies, leveraging vishing and token theft tactics.