Daily Dose of Cybersecurity News - August 29, 2025

What happened

Attackers exploited a breach in Salesloft's Drift integration, stealing OAuth tokens to access customer Salesforce instances and a limited number of Google Workspace email accounts.

Who is affected

Organizations using Salesloft's Drift integration with Salesforce and Google Workspace are impacted.

Why it matters

The breach exposes sensitive data, including AWS access keys and passwords, potentially leading to further unauthorized access and data exfiltration.

How it could have been prevented

Regularly auditing and securing OAuth tokens, implementing strict access controls, and monitoring integrations for unusual activities.

Recommended reading: Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks

What happened

A UK-based threat actor utilized Anthropic's Claude Code AI to develop and commercialize a ransomware-as-a-service (RaaS) platform, creating sophisticated ransomware tools with advanced evasion capabilities.

Who is affected

Organizations and individuals targeted by the RaaS operation, as well as the cybersecurity community monitoring AI-assisted cyber threats.

Why it matters

This incident highlights the potential misuse of AI technologies in cybercrime, enabling less skilled threat actors to develop complex malware, thereby increasing the frequency and sophistication of ransomware attacks.

How it could have been prevented

Implementing stricter access controls and monitoring mechanisms for AI development tools to prevent their exploitation by malicious actors.

Recommended reading: BleepingComputer

What happened

Click Studios identified a high-severity authentication bypass vulnerability in Passwordstate, allowing attackers to access the administration section without proper authentication.

Who is affected

Organizations using Passwordstate versions prior to 9.9 Build 9972 are vulnerable to this security flaw.

Why it matters

Exploitation of this vulnerability could grant unauthorized access to sensitive credentials, posing significant security risks to affected organizations.

How it could have been prevented

Regularly updating software to the latest versions and promptly applying security patches can mitigate such vulnerabilities.

Recommended reading: Passwordstate Changelog

What happened

MathWorks, the developer of MATLAB and Simulink, experienced a ransomware attack in April 2025, leading to the theft of personal data from over 10,000 individuals. The breach disrupted critical internal systems and customer-facing services, including multi-factor authentication, Single Sign-On, the MathWorks Cloud Center, file exchange, license center, and online store.

Who is affected

Over 10,000 individuals, including current and former MathWorks employees and customers, had their personal information compromised. The stolen data includes names, addresses, dates of birth, Social Security Numbers, and non-U.S. national identification numbers.

Why it matters

The exposure of sensitive personal information poses significant risks of identity theft and financial fraud for the affected individuals. Additionally, the disruption of MathWorks' services impacted numerous organizations and researchers relying on MATLAB and Simulink for critical projects, highlighting the vulnerability of essential software platforms to cyberattacks.

How it could have been prevented

Implementing robust network monitoring to detect unauthorized access promptly, ensuring timely application of security patches to prevent exploitation of vulnerabilities, and conducting regular security audits to identify and mitigate potential risks.

Recommended reading: MathWorks Trust Center: May 2025 Ransomware Incident

What happened

Security researchers identified multiple instances of Shadow IT-unauthorized systems and applications-exposing sensitive data through unsecured backups, open Git repositories, and unauthenticated admin panels.

Who is affected

Organizations with unmanaged or unknown IT assets that are accessible from the internet.

Why it matters

These exposures can lead to unauthorized access, data breaches, and potential exploitation by attackers, increasing the organization's risk profile.

How it could have been prevented

Implementing continuous asset discovery and monitoring to identify and secure unauthorized systems before they become exploitable.

Recommended reading: How to manage shadow IT and reduce your attack surface

What happened

TransUnion experienced a data breach on July 28, 2025, involving unauthorized access to a third-party application used in their U.S. consumer support operations. The breach exposed personal information of over 4.4 million individuals. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/transunion-suffers-data-breach-impacting-over-44-million-people/?utm_source=openai))

Who is affected

Approximately 4.4 million individuals in the United States, including 16,828 residents of Maine, had their personal information compromised. ([claimdepot.com](https://www.claimdepot.com/data-breach/transunion-2025-eb52b?utm_source=openai))

Why it matters

The exposed data includes sensitive personal information such as names, Social Security numbers, dates of birth, addresses, and government IDs. This information can be exploited for identity theft, financial fraud, and other malicious activities, posing significant risks to the affected individuals. ([claimdepot.com](https://www.claimdepot.com/data-breach/transunion-2025-eb52b?utm_source=openai))

How it could have been prevented

Implementing robust security measures for third-party applications, conducting regular security audits, and ensuring strict access controls could have mitigated the risk of unauthorized access.

Recommended reading: BleepingComputer

What happened

Government agencies, including CISA, FBI, and NSA, issued a joint advisory warning about Chinese state-sponsored cyber actors, notably Salt Typhoon, infiltrating global networks by exploiting known vulnerabilities in network devices.

Who is affected

Organizations in telecommunications, government, transportation, lodging, and defense sectors worldwide are targeted by these cyber actors.

Why it matters

The persistent access gained by these actors poses significant risks, including espionage and potential disruption of critical infrastructure services.

How it could have been prevented

Regularly applying security patches to address known vulnerabilities and monitoring network configurations for unauthorized changes can mitigate such threats.