It was just a little chat window in the corner of the screen.

The kind you see on thousands of websites every day. But behind it was a web of trusted connections reaching deep inside the enterprise.

In August 2025, attackers tracked as UNC6395 compromised OAuth tokens associated with Salesloft’s Drift integration, turning trusted connections to customer Salesforce environments into an attack path reaching hundreds of companies, including some of the world’s most sophisticated technology and cybersecurity organizations.

Instead of breaching those companies one by one, the attackers compromised trust upstream and inherited access downstream.

Then they went looking for more.

Inside stolen Salesforce data, the attackers reportedly searched for passwords, API keys, cloud credentials, and other secrets that could potentially open the next system, cloud environment, or application.

The Drift breach exposed a much larger problem.

Modern enterprises depend on thousands of connections between SaaS platforms, APIs, cloud services, applications, and third parties. Every connection creates business value, but it also extends trust and expands the attack surface.

What happens when something you trust becomes the attacker’s way in?

In this episode of The CISO Signal | True Cybercrime Podcast, host Jeremy Ladner is joined by Volker Rath, Field CISO APAC at Cloudflare, the sponsor of this episode, to investigate the Drift breach and what it reveals about the changing enterprise attack surface.

Together they explore:

• How UNC6395 turned compromised OAuth tokens into an attack path reaching hundreds of companies
• Why compromising one trusted integration can create a massive downstream blast radius
• What the attackers were searching for inside stolen Salesforce data
• How security teams detect malicious behavior hiding behind legitimate access
• Why even sophisticated cybersecurity companies can inherit risk from trusted connections
• Whether traditional third-party risk programs adequately measure that risk
• Why revoking compromised tokens may only be the beginning of incident response
• How AI could help attackers learn, adapt, and operate at machine speed
• Which assumptions about trusted applications and authorized connections CISOs may need to rethink

Your attack surface no longer ends at the edge of your network.

It extends through everything you trust.

🎙 This episode is sponsored by Cloudflare.

Cloudflare helps organizations connect and protect their people, applications, infrastructure, and networks across an increasingly distributed digital environment.

🌐 https://www.cloudflare.com

🎙 Guest Co-Host

Volker Rath
Field CISO APAC | Cloudflare

Volker works with security leaders and executives across the Asia-Pacific region on the changing realities of enterprise cybersecurity. In this episode, he joins Jeremy to examine what the Drift breach can teach CISOs about inherited trust, third-party risk, and protecting an enterprise increasingly connected to systems outside its direct control.

🔎 Episode Topics:

• Salesloft Drift breach
• UNC6395
• Salesforce security
• OAuth token compromise
• SaaS security
• Third-party risk
• Supply chain attacks
• API and cloud security
• Identity security
• Zero Trust
• Enterprise attack surface
• AI-powered cyberattacks
• Cloudflare
• CISO leadership

🧩 The CISO Signal links:

▶️ / @thecisosignal
💼 / the-ciso-signal
🌐 https://www.thecisosignal.com

👥 Join the Conversation:

If one of your organization’s trusted applications were compromised tomorrow, would your security team recognize when legitimate access had become malicious access?

Let us know what you think in the comments.

#CISOSignal #DriftBreach #Salesloft #Salesforce #UNC6395 #OAuth #SaaSSecurity #ThirdPartyRisk #CloudSecurity #IdentitySecurity #ZeroTrust #CyberSecurity #Cloudflare #CISO #TrueCybercrime

On June 19, 2024, thousands of car dealerships across North America opened for what looked like an ordinary business day.
The vehicles were on the lot.
The sales teams were ready.
The service bays were full.
Then the software stopped working.
Within hours, more than 15,000 dealerships lost access to the systems that powered nearly every part of their business: vehicle sales, financing, inventory, repair orders, customer records, payroll, and parts management.
The target wasn't the dealerships.
It was the company almost nobody had heard of...
CDK Global.
What followed wasn't simply another ransomware attack.
It became a real-world demonstration of what happens when an entire industry becomes dependent on a single technology platform—and what happens when that platform suddenly disappears.

In this episode of The CISO Signal | True Cybercrime Podcast, host Jeremy Ladner is joined by Benjamin Lipczynski, Director of Cybersecurity & Regulatory Services at Origina, the sponsor of this episode, and Christopher Russell, Chief Information Security Officer at tZERO Group, to investigate one of the largest supply-chain ransomware incidents ever to impact North American commerce.

Together they explore:
• Who BlackSuit really is and how modern ransomware groups operate
• Why CDK became such an attractive target
• How a single software platform became a single point of failure for an entire industry
• Why attackers seek persistence long before they demand payment
• The difficult decisions defenders face when shutting down critical systems
• Why recovery is often far more difficult than the attack itself
• The cybersecurity lessons every CISO should take from the CDK incident

Because sometimes the biggest cyber attacks don't target thousands of companies...
They target the one company that thousands of businesses depend on.
________________________________________
🎙 This episode is sponsored by Origina.

Modern enterprises often depend on mission-critical IBM, HCL, and VMware environments that simply can't afford unnecessary disruption. Origina helps organizations extend the life of these critical platforms through independent third-party software support and cybersecurity expertise, giving customers greater control over their infrastructure, reducing unnecessary vendor-driven upgrades, and helping IT and security leaders build resilient, long-term technology strategies.
🌐 https://www.origina.com
________________________________________

🎙 Guest Co-Hosts
Benjamin Lipczynski
Director, Cybersecurity & Regulatory Services | Origina
Benjamin has more than 20 years of experience across defense, critical infrastructure, incident response, and cybersecurity strategy. At Origina, he works with enterprise security and IT leaders to reduce operational risk, strengthen resilience, and protect the mission-critical environments organizations depend on every day.

Christopher Russell
Chief Information Security Officer | tZERO Group
Chris has spent more than two decades leading cybersecurity, intelligence, cloud security, and security operations across both military and commercial environments.
________________________________________
🔎 Episode Topics
• CDK Global ransomware attack
• BlackSuit ransomware
• Supply chain cyber attacks
• Third-party risk
• Single points of failure
• Incident response
• Business continuity
• Disaster recovery
• Enterprise resilience
• Critical infrastructure
• CISO leadership
• Cyber resilience
________________________________________
🧩 About The CISO Signal
True cybercrime storytelling with real CISO lessons.
▶️ https://www.youtube.com/@TheCISOSignal
💼 https://www.linkedin.com/company/the-ciso-signal
🌐 https://www.thecisosignal.com
________________________________________
👥 Join the Conversation
At what point does operational efficiency become operational dependency?
Can any organization justify relying on a single platform to run every critical business function?
Let us know what you think in the comments.
________________________________________
#CISOSignal #CDK #CDKGlobal #BlackSuit #Ransomware #CyberSecurity #SupplyChain #ThirdPartyRisk #IncidentResponse #BusinessContinuity #CyberResilience #CISO #TrueCybercrime

The Change Healthcare Breach | Healthcare Hijacked

🎙 With guest co-hosts Thomas Schwab and Scott Kisser

For most people, healthcare feels immediate.

A doctor.

A prescription.

A moment of care.

What they don’t see…

is everything that has to happen before any of that is allowed to move.

Claims must be approved.

Payments must clear.

Authorizations must pass through systems no patient has ever heard of.

At the center of that system sat Change Healthcare.

When it worked, no one noticed.

In February 2024, it stopped.

No zero-day.

No advanced exploit.

Just stolen credentials…

and a remote access portal without multi-factor authentication.

Attackers linked to ALPHV/BlackCat logged in.

And from there, everything followed.

They moved laterally.

Exfiltrated sensitive data.

And deployed ransomware inside one of the most critical financial pipelines in American healthcare.

Pharmacies could not process prescriptions.

Providers could not submit claims.

Payments froze.

Care was not denied.

But it was delayed.

And delay, in healthcare, carries weight.

What followed was not just a breach.

It was a system-wide disruption that exposed a hard truth:

Modern healthcare does not just depend on technology.

It depends on a small number of systems working exactly as expected.

In this episode of The CISO Signal | True Cybercrime Podcast, host Jeremy Ladner is joined by Thomas Schwab of 1st Cyber Operations Group and Scott Kisser to examine how dependency becomes a weapon, why identity failures now carry systemic risk, and what leaders are forced to decide when every option comes with consequence.

Because in cybersecurity, the most dangerous attacks don’t break systems.

They use them exactly as designed.

🎙 Guest CISO Co-Host

Scott Kisser:

Chief Information Security Office @ SmithRx

https://www.smithrx.com

🤝 Sponsor Expert

Thomas Schwab:

Managing Director, 1st Cyber Operations Group

https://www.1stCyberOpsGroup.com

1st Cyber Operations Group helps organizations strengthen cyber resilience and incident response readiness, ensuring leaders can make confident decisions under pressure and recover quickly when disruption occurs.

🔎 Episode Topics

• How a lack of MFA enabled one of the largest healthcare breaches in history

• Why attackers target dependency and not endpoints

• Identity as the true perimeter in modern enterprise environments

• The operational consequences of ransomware in critical infrastructure

• How leaders make decisions when every option carries risk

🧩 About The CISO Signal

True cybercrime storytelling with real CISO lessons.

▶️ https://www.youtube.com/@TheCISOSignal

💼 https://www.linkedin.com/company/the-ciso-signal

🌐 https://www.thecisosignal.com

👥 Join the Conversation

The CISO Signal Cybersecurity Leadership Forum

https://www.linkedin.com/groups/17974008

#CISOSignal #ChangeHealthcare #CyberSecurity

#Ransomware #HealthcareSecurity #CyberResilience

#CISO #TrueCybercrime

The Equifax Breach | One of the Largest Data Exposures in History

🎙 With Jeremy Ladner and guest co-hosts Kavitha Mariappan and Mark Dorsi

For months, the warning was sitting in plain sight.

A critical vulnerability.

Publicly disclosed.

Actively exploited.

A patch was available.

Inside one of the largest credit reporting agencies in the world, the system remained exposed.

No zero-day.

No advanced exploit chain.

Just a missed update.

In May 2017, attackers began exploiting a known flaw in the Apache Struts framework.

The vulnerability allowed remote code execution.

Unauthenticated.

Unrestricted.

From the outside, it looked like routine traffic.

Inside the network, it was something else.

They accessed databases.

Queried records.

And began extracting one of the most sensitive datasets imaginable.

Names.

Social Security numbers.

Birth dates.

Addresses.

The identity layer of nearly half the United States population.

For 76 days, the activity continued.

No alarms.

No interruption.

Until it was too late.

By the time Equifax disclosed the breach in September 2017, approximately 147 million individuals had been affected.

Executives resigned.

Investigations launched.

Congress intervened.

But the breach itself had already unfolded.

Because this was not a story about attackers breaking through hardened defenses. It was a story about what happens when a known vulnerability remains unpatched inside a system that holds national-scale data.

In this episode of The CISO Signal | True Cybercrime Podcast, host Jeremy Ladner is joined by Kavitha Mariappan of Rubrik and Mark Dorsi, CISO at Netlify, to examine how a single missed control can cascade into systemic failure, why patch management must be operationalized not assumed, and what resilience actually means when prevention fails.

Because in cybersecurity, the most dangerous vulnerabilities are often the ones already documented. And already waiting.

🎙 Guest CISO Co-Host

Mark Dorsi

Chief Information Security Officer

Netlify

https://www.netlify.com

🤝 Sponsor Expert

Kavitha Mariappan

Chief Transformation Officer, Rubrik

https://www.rubrik.com

Rubrik delivers cyber resilience by securing data across enterprise, cloud, and SaaS environments, enabling organizations to recover quickly from cyber incidents and maintain operational continuity.

🔎 Episode Topics

• The Apache Struts vulnerability (CVE-2017-5638) and how it was exploited

• Why patch management failures still drive catastrophic breaches

• How attackers operated undetected inside Equifax systems for over two months

• The difference between prevention failure and resilience failure

• What security leaders must operationalize to avoid systemic exposure

🧩 About The CISO Signal

True cybercrime storytelling with real CISO lessons.

▶️ / @thecisosignal

💼 / the-ciso-signal

🌐 https://www.thecisosignal.com

👥 Join the Conversation

The CISO Signal Cybersecurity Leadership Forum

/ 17974008

#CISOSignal #EquifaxBreach #CyberSecurity

#DataBreach #PatchManagement #CyberResilience

#CISO #TrueCybercrime

The AT&T Beijing Breach | Metadata Maps That Intelligence Services Want

With guest co-host John Carse, Field CISO at SquareX

In 2024, attackers did not steal call recordings.
They did not intercept encrypted text messages.
They went after something quieter.
Call detail records.
The outlines of conversations.
Phone numbers.
Timestamps.
Durations.
Cell tower connections.
Metadata that, on its own, seems technical. Harmless. Operational.
But at telecom scale, metadata becomes something else.
Between April and early June 2024, attackers accessed systems containing call and text metadata tied to approximately 86 million AT&T customers. The intrusion was traced to a third-party cloud environment associated with AT&T’s data operations. Investigators later pointed to compromised credentials discovered in a Snowflake environment after a phishing attack and infostealer infection inside a vendor ecosystem.
No ransomware encryption.
No service outage.
No dramatic system shutdown.
Instead, approximately $370,000 in cryptocurrency was reportedly paid in an effort to prevent public exposure of the dataset.
Some analysts linked the activity to a cluster labeled UNC5537.

Other reporting mentioned data brokerage ecosystems such as ShinyHunters. Researchers, including those at Mandiant, urged caution on attribution, noting behavior consistent with criminal monetization rather than confirmed state-sponsored espionage.

There is no public evidence that this dataset was used for intelligence operations.
There is also no way to prove that it was not.

Because telecom metadata does not just describe calls.
It describes relationships.
Who speaks to whom.
How often.
From where.
Which towers were touched along the way.

For criminals, that information enables SIM swapping, fraud, and targeted phishing.
For nation states, it can illuminate social graphs, travel patterns, and networks of influence.

In this episode of The CISO Signal | True Cybercrime Podcast, we examine how third-party access became the breach path, why metadata is often more strategically valuable than content, and what happens when operational data quietly becomes intelligence-grade material.
This is not a story about encryption failing.
It is a story about accumulation.

🎙 Guest Co-Host
John Carse
Field CISO, SquareX
Three-time CISO and host of Be Fearless: The CISO Perspective

🔍 Episode Topics
• What telecom metadata actually reveals beyond call content
• Why large telecom providers are high-value intelligence targets
• How third-party access and credential reuse created the breach path
• Snowflake, vendor risk, and the anatomy of cloud miscalculation
• The criminal data brokerage ecosystem and resale supply chains
• Why metadata can be more operationally useful than call recordings
• Inside the first 24 hours of executive response and board escalation
• How security debt surfaces after a third-party breach
• Why threat models must evolve when operational systems become intelligence repositories

🧊 The Aftershock
On July 12, 2024, AT&T publicly acknowledged the breach, confirming that call and text content were not accessed.
But the exposure shifted the conversation.
Privacy experts noted that metadata can reveal business relationships, political activity, religious observance, romantic connections, and movement patterns, without ever recording a single word.
Later reporting connected the broader Snowflake-related campaign to individuals including John Erin Binns and Connor Moucka, though attribution questions remain complex and evolving.
What makes the AT&T breach different is not technical spectacle.
It is the quiet reality that behavioral data, once accumulated at scale, becomes strategic.
Every organization that logs user behavior now holds a map.
And every map attracts attention.

🧩 About The CISO Signal
True cybercrime storytelling with real CISO lessons.
Subscribe so you never miss an investigation.
👉 @thecisosignal
👉 www.linkedin.com/company/the-ciso-signal
👉 www.theCISOsignal.com

#CISOSignal #ATTBreach #Metadata #Snowflake
#CyberEspionage #ThirdPartyRisk #TelecomSecurity #CISO #TrueCybercrime