The Salesloft Drift breach that compromised "hundreds" of companies including Google, Palo Alto Networks, and Cloudflare, all started with miscreants gaining access to the Salesloft GitHub account in March.

This new information comes from a Saturday update into the Mandiant-led investigation - Salesloft hired the incident response firm to determine the root cause and scope of the incident - and a Sunday alert that the integration between Salesloft and Salesforce has now been restored.

We now know that crims got their initial access sometime in March. Between then and June, the attackers accessed the Salesloft GitHub account, downloaded content from "multiple" repositories, added a guest user, and established workflows.

The postmortem doesn't say how the intruders gained access to the Gi

See Full Page