10th September 2025 Cyber Update: Tenable Confirms Data Breach in Widespread Supply Chain Attack

The Update: Cybersecurity firm Tenable has confirmed it was among hundreds of organisations affected by a supply chain style data theft campaign involving Salesforce and the Salesloft Drift integration. Attackers are believed to have gained access to Salesloft’s GitHub account between March and June 2025 and later used stolen OAuth tokens from Drift to extract data between August 8 and August 18. The campaign, attributed to the group known as UNC6395, targeted Salesforce environments and harvested sensitive credentials such as AWS keys, passwords and Snowflake tokens.

Google’s Threat Intelligence Group has estimated that more than 700 organisations may have been impacted. For Tenable, the exposure was limited to case subject lines, initial case descriptions and basic business contact information stored in Salesforce. The company stressed that its products and the data within them were not affected. In response, Tenable revoked and rotated credentials, disabled the Drift integration and further hardened its systems.

Why It Matters: The Tenable incident highlights how attackers are increasingly exploiting third party integrations to infiltrate trusted platforms. The campaign shows how a single compromise in the software supply chain can cascade across hundreds of organisations, including major security vendors.

The breach underscores the importance of closely monitoring third party connections, enforcing strict credential management and adopting layered defences that extend beyond internal systems. Even cybersecurity firms can become victims, demonstrating the sophistication of today’s threat actors and the ongoing need for vigilance in managing external dependencies.