We recently became aware of a widespread Salesloft / Drift supply chain incident that impacted third-party integrations with Drift. We are providing this update as part of our commitment to transparency and keeping our customers informed about the security of our platform and products. The key takeaway is that there is no impact on the Qualys production environments (shared platforms and private platforms), codebase, or customer data hosted on the Qualys Cloud Platform, Qualys Agents or Scanners. All Qualys platforms continue to be fully functional, and at no time was there any operational impact. What Happened? Qualys was made aware of a campaign targeting Salesloft Drift (a marketing software-as-a-service) that impacted a large number of Salesloft customers, including Qualys. The incident involved the theft of OAuth tokens connected to Salesloft Drift, a third-party application used to automate sales workflows and integrate with Salesforce for managing leads and contact information. Our investigation found that these credentials allowed limited access to some Qualys Salesforce information. Qualys Response Upon learning of the incident, Qualys immediately activated our incident response plan and: Disabled all Drift integrations with Qualys’ Salesforce data Worked to contain any potential unauthorized access Launched a thorough investigation working closely with Salesforce To support our investigation, we have also engaged Mandiant, which is supporting many of the…Read More
Salesloft Drift Supply Chain Incident
