SaaS Breaches Start with Tokens - What Security Teams Must Watch
Summary: Token theft is described as a leading cause of SaaS breaches, with OAuth access tokens, API keys, and session tokens letting attackers bypass MFA and other controls. The article cites Slack and CircleCI in January 2023, Cloudflare/Okta in November 2023, and Salesloft/Drift in August 2025, where harvested OAuth tokens gave access to hundreds of customer organizations' SaaS data. The piece attributes the pattern to SaaS sprawl, noting enterprises manage roughly 490 cloud apps and that each integration creates a non-human identity usually invisible to IT.
What's compelling: Cloudflare rotated about 5,000 credentials after an identity provider breach, yet one unrotated API token and some service account credentials were enough to compromise its Atlassian environment. With roughly 490 cloud apps per enterprise and OAuth tokens that never prompt for MFA, a single forgotten credential can undo an otherwise thorough incident response.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026