{"id":420,"date":"2025-09-11T08:55:24","date_gmt":"2025-09-11T11:55:24","guid":{"rendered":"https:\/\/boasvindas.engdb.com.br\/?p=420"},"modified":"2026-04-06T12:18:54","modified_gmt":"2026-04-06T15:18:54","slug":"alert-risk-of-social-engineering-attacks-due-to-salesloft-data-breach","status":"publish","type":"post","link":"https:\/\/boasvindas.engdb.com.br\/?p=420","title":{"rendered":"Alert: risk of social engineering attacks due to Salesloft data breach"},"content":{"rendered":"<p data-ogsc=\"\" data-olk-copy-source=\"MessageBody\">Last August, a\u00a0<span data-ogsc=\"\">serious<\/span>\u00a0&#8220;<span data-ogsc=\"\">Supply Chain&#8221; cyberattack<\/span>\u00a0came to light, allowing a malicious actor to\u00a0<span data-ogsc=\"\">unlawfully extract personal data<\/span>\u00a0from the archives of over 700 companies, including leading multinational corporations in the technology sector.<\/p>\n<p data-ogsc=\"\"><span data-ogsc=\"rgb(198, 25, 139)\">How was the attack carried out?<\/span><\/p>\n<p data-ogsc=\"\">The attackers compromised\u00a0<span data-ogsc=\"\">Salesloft Drift<\/span>, a cloud-based automation service that companies integrate with other software platforms, most notably\u00a0<span data-ogsc=\"\">Salesforce<\/span>\u00a0&#8211; the world\u2019s most widely used\u00a0<a dir=\"auto\" title=\"https:\/\/en.wikipedia.org\/wiki\/Customer_relationship_management\" href=\"https:\/\/en.wikipedia.org\/wiki\/Customer_relationship_management\" data-auth=\"NotApplicable\" data-linkindex=\"3\" data-ogsc=\"rgb(38, 139, 206)\">CRM<\/a>\u00a0&#8211;\u00a0<span data-ogsc=\"\">Google Workspace<\/span>, and\u00a0<span data-ogsc=\"\">Slack.<\/span><br \/>\nThe attackers gained access to all the data that these platforms made available to Drift.<br \/>\nFor more technical details, please refer to\u00a0<a dir=\"auto\" title=\"https:\/\/socradar.io\/salesloft-drift-breach-everything-you-need-to-know\/\" href=\"https:\/\/socradar.io\/salesloft-drift-breach-everything-you-need-to-know\/\" data-auth=\"NotApplicable\" data-linkindex=\"4\" data-ogsc=\"rgb(38, 139, 206)\">Socradar.io<\/a>.<\/p>\n<p data-ogsc=\"\"><span data-ogsc=\"rgb(198, 25, 139)\">What data was exfiltrated, and from whom?<\/span><\/p>\n<p data-ogsc=\"\">Following the compromise of Drift, several companies publicly disclosed that they had suffered data breaches, often involving information related to personnel from their client organisations. The most commonly affected data includes:<\/p>\n<ul data-ogsc=\"\">\n<li data-ogsc=\"\">First and last names<\/li>\n<li data-ogsc=\"\">Email addresses<\/li>\n<li data-ogsc=\"\">Phone numbers<\/li>\n<li data-ogsc=\"\">Job titles and roles<\/li>\n<\/ul>\n<p data-ogsc=\"\">However,\u00a0<span data-ogsc=\"\">it is not currently possible to determine exactly how many companies were affected<\/span>\u00a0and\u00a0<span data-ogsc=\"\">which specific data was stolen<\/span>.<\/p>\n<p data-ogsc=\"\"><span data-ogsc=\"rgb(198, 25, 139)\">Is the Engineering Group affected?<\/span><\/p>\n<p data-ogsc=\"\">The Engineering Group\u2019s systems\u00a0<span data-ogsc=\"\">have not been attacked<\/span>.<br \/>\nHowever,\u00a0<span data-ogsc=\"\">data has been stolen from the systems of other organisations that have relationships with Engineering<\/span>\u00a0(e.g. suppliers, partners&#8230;), including information about certain individuals within our Group who have or had administrative, commercial, or technical dealings with them.<br \/>\nWe are actively monitoring the situation and contacting all affected third parties with whom we have relationships, in order to obtain details about the nature of the impacted data.<\/p>\n<p data-ogsc=\"\"><span data-ogsc=\"rgb(198, 25, 139)\">Why is this scenario so critical?<\/span><\/p>\n<p data-ogsc=\"\">Through this attack, malicious actors have obtained a large amount of information about companies in our sector, their commercial relationships, and the individuals who manage them.<br \/>\nSuch information enables cybercriminals to carry out highly convincing\u00a0<span data-ogsc=\"\">social engineering<\/span>\u00a0attacks, aimed at extracting further data, compromising IT systems, and achieving financial gain.<\/p>\n<p data-ogsc=\"\"><span data-ogsc=\"rgb(198, 25, 139)\">What does this mean for each of us?<\/span><\/p>\n<p data-ogsc=\"\">The risk is increasing that any of us may be contacted by criminals posing as companies or third parties with whom we have existing relationships.<\/p>\n<p>We may receive messages via\u00a0<span data-ogsc=\"\">email<\/span>\u00a0(phishing),\u00a0<span data-ogsc=\"\">chat<\/span>,\u00a0<span data-ogsc=\"\">SMS<\/span>\u00a0(smishing), and\u00a0<span data-ogsc=\"\">social media\u00a0<\/span>(e.g. LinkedIn), and in some cases\u00a0<span data-ogsc=\"\">phone calls<\/span>\u00a0or\u00a0<span data-ogsc=\"\">voice messages<\/span>\u00a0(vishing), asking for information or urging us to take immediate action.<\/p>\n<p>Thanks to the use of artificial intelligence, attackers may carry out highly realistic contact attempts,\u00a0<span data-ogsc=\"\">replicating images<\/span>\u00a0<span data-ogsc=\"\">or<\/span>\u00a0<span data-ogsc=\"\">voices<\/span>\u00a0of colleagues, suppliers, clients, and partners.<\/p>\n<p data-ogsc=\"\"><span data-ogsc=\"rgb(198, 25, 139)\">How to protect yourself<\/span><\/p>\n<p data-ogsc=\"\"><span data-ogsc=\"\">Be cautious and verify<\/span>\u00a0&#8211; pay attention to:<\/p>\n<ul data-ogsc=\"\">\n<li data-ogsc=\"\"><span data-ogsc=\"\">Emails<\/span>\u00a0and\u00a0<span data-ogsc=\"\">messages<\/span>\u00a0that request urgent actions or contain suspicious links or attachments<\/li>\n<li data-ogsc=\"\"><span data-ogsc=\"\">Phone calls<\/span>\u00a0or\u00a0<span data-ogsc=\"\">SMS<\/span>\u00a0from unusual numbers asking for personal or company-related information<\/li>\n<li data-ogsc=\"\">Unexpected or unusual\u00a0<span data-ogsc=\"\">communications<\/span>, even if they appear to come from colleagues or third parties you work with.<\/li>\n<\/ul>\n<p data-ogsc=\"\"><span data-ogsc=\"\">Do not share<\/span>\u00a0personal or company information unless you are certain of the identity of the person contacting you. If in doubt, reach out to them through a separate channel.<\/p>\n<p data-ogsc=\"\"><span data-ogsc=\"\">Always report<\/span>\u00a0&#8211; without delay:<\/p>\n<ul data-ogsc=\"\">\n<li data-ogsc=\"inherit\"><span data-ogsc=\"inherit\">Any<\/span>\u00a0<span data-ogsc=\"\">suspicious email<\/span>\u00a0using the \u201c<span data-ogsc=\"\"><a dir=\"auto\" title=\"https:\/\/engage.eng.it\/en\/internal-communications\/phishalarm\" href=\"https:\/\/engage.eng.it\/en\/internal-communications\/phishalarm\" data-auth=\"NotApplicable\" data-linkindex=\"5\" data-ogsc=\"rgb(38, 139, 206)\">Report suspicious message<\/a><\/span>\u201d<span data-ogsc=\"inherit\">\u00a0button available in Outlook<\/span><\/li>\n<li data-ogsc=\"inherit\"><span data-ogsc=\"inherit\">Any suspicious contact attempts via\u00a0phone, messages\u00a0or\u00a0chat\u00a0related to work matters, by writing to\u00a0<\/span><span data-ogsc=\"inherit\">security@eng.it e csirt@cybertech.eu<\/span><\/li>\n<\/ul>\n<p data-ogsc=\"\"><span data-ogsc=\"\">Train your mind<\/span>\u00a0&#8211; be aware that the daily habit of working with digital devices can create a false sense of security.<br \/>\n<span data-ogsc=\"\">Be prepared<\/span>\u00a0for the possibility that you could be the target of an attack.\u00a0<span data-ogsc=\"\">Think<\/span>\u00a0about the moments when you might be most\u00a0<span data-ogsc=\"\">vulnerable:<\/span>\u00a0you could receive a malicious email among dozens of legitimate ones on the day of an important deadline, or a phone call while driving, a voice message on the train, or an SMS while on holiday.<br \/>\n<span data-ogsc=\"\">Imagine how you would react<\/span>\u00a0to different types of approaches attackers might use: polite or urgent requests, attempts to make you feel at fault (e.g. you&#8217;re late, you haven&#8217;t done your job), or at risk (e.g. you&#8217;ll lose access to your data, we\u2019ll expose your information&#8230;).<\/p>\n<p data-ogsc=\"\">You are the\u00a0<span data-ogsc=\"\">#FirstLineofDefence<\/span>\u00a0&#8211; the barrier cybercriminals try to breach every day.<br \/>\nYour awareness and preparedness are the hardest obstacles for them to overcome.<\/p>\n<p>Thank you for your cooperation<\/p>\n<p data-ogsc=\"\"><strong>Group Information Security Office<\/strong><br \/>\n<strong>Group Data Protection Office<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Last August, a\u00a0serious\u00a0&#8220;Supply Chain&#8221; cyberattack\u00a0came to light, allowing a malicious actor to\u00a0unlawfully extract personal data\u00a0from<span class=\"excerpt-hellip\"> [\u2026]<\/span><\/p>\n","protected":false},"author":4,"featured_media":196,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_feature_clip_id":0,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_post_was_ever_published":false},"categories":[4],"tags":[],"class_list":["post-420","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-seguranca"],"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"https:\/\/boasvindas.engdb.com.br\/wp-content\/uploads\/2024\/03\/9jZdLCAofCB4BVucHkrRAk9hTFJjQkVzLkSLQgmF.jpg","_links":{"self":[{"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/posts\/420","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=420"}],"version-history":[{"count":1,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/posts\/420\/revisions"}],"predecessor-version":[{"id":421,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/posts\/420\/revisions\/421"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=\/wp\/v2\/media\/196"}],"wp:attachment":[{"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=420"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=420"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/boasvindas.engdb.com.br\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=420"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}