Alert: risk of social engineering attacks due to Salesloft data breach

Last August, a serious “Supply Chain” cyberattack came to light, allowing a malicious actor to unlawfully extract personal data from the archives of over 700 companies, including leading multinational corporations in the technology sector.

How was the attack carried out?

The attackers compromised Salesloft Drift, a cloud-based automation service that companies integrate with other software platforms, most notably Salesforce – the world’s most widely used CRM – Google Workspace, and Slack.
The attackers gained access to all the data that these platforms made available to Drift.
For more technical details, please refer to Socradar.io.

What data was exfiltrated, and from whom?

Following the compromise of Drift, several companies publicly disclosed that they had suffered data breaches, often involving information related to personnel from their client organisations. The most commonly affected data includes:

• First and last names
• Email addresses
• Phone numbers
• Job titles and roles

However, it is not currently possible to determine exactly how many companies were affected and which specific data was stolen.

Is the Engineering Group affected?

The Engineering Group’s systems have not been attacked.
However, data has been stolen from the systems of other organisations that have relationships with Engineering (e.g. suppliers, partners…), including information about certain individuals within our Group who have or had administrative, commercial, or technical dealings with them.
We are actively monitoring the situation and contacting all affected third parties with whom we have relationships, in order to obtain details about the nature of the impacted data.

Why is this scenario so critical?

Through this attack, malicious actors have obtained a large amount of information about companies in our sector, their commercial relationships, and the individuals who manage them.
Such information enables cybercriminals to carry out highly convincing social engineering attacks, aimed at extracting further data, compromising IT systems, and achieving financial gain.

What does this mean for each of us?

The risk is increasing that any of us may be contacted by criminals posing as companies or third parties with whom we have existing relationships.

We may receive messages via email (phishing), chat, SMS (smishing), and social media (e.g. LinkedIn), and in some cases phone calls or voice messages (vishing), asking for information or urging us to take immediate action.

Thanks to the use of artificial intelligence, attackers may carry out highly realistic contact attempts, replicating images or voices of colleagues, suppliers, clients, and partners.

How to protect yourself

Be cautious and verify – pay attention to:

• Emails and messages that request urgent actions or contain suspicious links or attachments
• Phone calls or SMS from unusual numbers asking for personal or company-related information
• Unexpected or unusual communications, even if they appear to come from colleagues or third parties you work with.

Do not share personal or company information unless you are certain of the identity of the person contacting you. If in doubt, reach out to them through a separate channel.

Always report – without delay:

• Any suspicious email using the “Report suspicious message” button available in Outlook
• Any suspicious contact attempts via phone, messages or chat related to work matters, by writing to security@eng.it e csirt@cybertech.eu

Train your mind – be aware that the daily habit of working with digital devices can create a false sense of security.
Be prepared for the possibility that you could be the target of an attack. Think about the moments when you might be most vulnerable: you could receive a malicious email among dozens of legitimate ones on the day of an important deadline, or a phone call while driving, a voice message on the train, or an SMS while on holiday.
Imagine how you would react to different types of approaches attackers might use: polite or urgent requests, attempts to make you feel at fault (e.g. you’re late, you haven’t done your job), or at risk (e.g. you’ll lose access to your data, we’ll expose your information…).

You are the #FirstLineofDefence – the barrier cybercriminals try to breach every day.
Your awareness and preparedness are the hardest obstacles for them to overcome.

Thank you for your cooperation

Group Information Security Office
Group Data Protection Office