WHAT THE SALESLOFT DRIFT BREACHES REVEAL ABOUT 4TH-PARTY RISK

Summary from the TLDR InfoSec newsletter

The SalesLoft Drift breach demonstrates the emerging threat of "fourth-party" risk, where organizations are compromised through their vendor's acquired company (Drift) rather than direct vendor relationships. Attackers exploited legacy OAuth tokens that had been dormant for 18 months since SalesLoft's 2024 acquisition of Drift, allowing access to hundreds of Salesforce instances and Google Workspace accounts. This incident highlights how M&A activities can inherit hidden security risks that extend organizations' attack surfaces far beyond what they can directly assess or control through traditional security measures.