Tenable Confirms Data Breach Exposing Customer Contact Information

Cybersecurity firm Tenable has confirmed its involvement in a large-scale data theft campaign targeting organizations using integrated Salesforce and Salesloft Drift applications.

The vulnerability management company disclosed that unauthorized actors gained access to customer support data stored within its Salesforce Customer Relationship Management (CRM) instance, marking another significant breach in the Software-as-a-Service (SaaS) ecosystem.

The incident affected customer support case information, including ticket subject lines, initial problem descriptions, and standard business contact data such as names, corporate email addresses, phone numbers, and geographical identifiers.

Critically, Tenable emphasized that its core vulnerability assessment products and the broader Tenable One platform remained uncompromised throughout the incident.

The breach leveraged vulnerabilities in third-party application integrations, specifically targeting the connection between Salesforce instances and Salesloft’s Drift conversational marketing platform.

This attack vector represents a growing concern in enterprise security, where Application Programming Interface (API) integrations between SaaS platforms create expanded attack surfaces for malicious actors.

Comprehensive Security Response

Tenable’s incident response demonstrated industry best practices for SaaS security breaches.

The company implemented a multi-layered remediation approach, beginning with immediate credential revocation across all potentially compromised systems.

This included rotating authentication tokens for Salesforce, Drift, and associated integration endpoints to prevent continued unauthorized access.

The company’s security team executed environment hardening procedures, implementing additional access controls and authentication mechanisms within their Salesforce org.

They completely removed the Salesloft Drift application from their Salesforce instance, eliminating the compromised integration pathway.

Tenable deployed Indicators of Compromise (IoCs) provided by Salesforce and leading threat intelligence sources, enabling proactive detection of similar attack patterns.

The company enhanced its continuous monitoring capabilities using SaaS Security Posture Management (SSPM) technology, which provides real-time visibility into cloud application configurations and potential security exposures.

Security Measure	Implementation Details	Purpose
Credential Rotation	Revoked all Salesforce, Drift, and integration tokens	Prevent continued unauthorized access
System Hardening	Enhanced Salesforce environment security controls	Reduce future exploitation risk
Application Removal	Disabled and uninstalled Salesloft Drift integration	Eliminate attack vector
IoC Deployment	Applied threat intelligence indicators	Enable proactive threat detection
SSPM Monitoring	Continuous SaaS security posture assessment	Real-time exposure identification

This incident highlights the critical importance of third-party risk management in modern enterprise security architectures.

Organizations increasingly rely on SaaS application ecosystems connected through APIs and integrations, creating complex interdependencies that can be exploited by sophisticated threat actors.

The Tenable disclosure reinforces the need for robust SaaS Security Posture Management solutions that can continuously monitor cloud application configurations, detect unauthorized access attempts, and maintain visibility across integrated platforms.

As enterprises continue digital transformation initiatives, implementing comprehensive third-party risk assessment frameworks becomes essential for maintaining data protection standards and regulatory compliance requirements.

Find this Story Interesting! Follow us on Google News, LinkedIn and X to Get More Instant Updates

The post Tenable Confirms Data Breach Exposing Customer Contact Information appeared first on Cyber Security News.