Threat Intelligence Brief
Curated summary with source attribution
Source: cloudskope.com
Threat Risk: High
Victim: TransUnion / US Consumers
Incident: Data breach resulting from compromised third-party OAuth tokens.
Impact: Exposure of PII for approximately 4.4 million individuals, including unredacted Social Security numbers.
Attacker: ShinyHunters (UNC6395)
Analysis: Attackers bypassed traditional perimeter defenses by leveraging stolen OAuth tokens associated with the Salesloft Drift integration. This allowed unauthorized access to a Salesforce instance without compromising the core Salesforce platform or TransUnion’s internal servers. The incident highlights a broader campaign targeting interconnected SaaS ecosystems and the inherent risks of trusted third-party application permissions.
Recommendations: Audit and rotate OAuth tokens for all third-party SaaS integrations regularly.; Implement strict least-privilege access controls for third-party application permissions.; Monitor for anomalous data exfiltration patterns coming from trusted cloud integration points.
Source: Cloudskope
Editorial note: this post summarizes third-party reporting and links to the original source.
View Original Source