> ## Content Index > Fetch the complete content index at: https://unlocked.everykey.com/llms.txt > Use this file to discover other available public pages before exploring further. # September Recap - The Breach Report - URL: https://unlocked.everykey.com/september-recap-the-breach-report/ - Published: 2025-10-16T18:00:32.000Z - Updated: 2026-06-24T16:18:45.000Z - Description: Volvo, Stellantis, Cloudflare, WestJet, DraftKings and more — the top 7 data breaches of September 2025 with key themes: supply-chain and OAuth misuse. - Author: Nick Marsteller - Tags: The Breach Report, #beehiiv, #Import 2026-04-29 08:19 Hello and welcome back to **The Breach Report!** September delivered another round of high-stakes breaches — targeting fintech, auto, SaaS platforms, and even the airline industry — with attackers yet again capitalizing on weak vendor systems, token misuse, and third-party dependencies. The recurring themes? **Supply-chain compromise, OAuth/token misuse, and vendor ecosystem gaps.** Follow along and subscribe to stay ahead of what’s next in cyber threat and data breach news. --- ## 🚨 Top 7 Data Breaches of September 2025 ### 1\. Volvo / Miljödata Vendor Breach (Global / USA impact) - **What happened:** A ransomware attack on the HR software provider Miljödata compromised Volvo’s employee data (as well as data from other clients) in late September. - **Impact:** Exposed names, government IDs, addresses, and SSNs for some U.S. employees. No payroll or financial data was affected (per company statements). - **Lesson:** Even your HR vendor must meet the same scrutiny as your core systems — identity and employee data are high-value targets. - **Source:** [**Read More**](https://breached.company/volvo-group-north-america-hit-by-massive-third-party-ransomware-attack-870-000-accounts-exposed/?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=september-recap-the-breach-report) --- ### 2\. Stellantis / Salesforce Supply-Chain Incident (USA / Global) - **What happened:** Stellantis confirmed a data breach linked to the ongoing Salesforce / Salesloft/Drift OAuth token exploitation campaign. - **Impact:** Internal documents, communications, and personal data of employees, customers, and suppliers were exposed. - **Lesson:** The “ripple effect” from a single SaaS integration continues to wreak havoc across industries. - **Source:** [**Read More**](https://www.esecurityplanet.com/threats/stellantis-hack-exposes-18m-records-shinyhunters-strike/?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=september-recap-the-breach-report) --- ### 3\. Wealthsimple (Canada / Fintech) - **What happened:** A data breach was disclosed in early September, traced to a compromised third-party software module tied to the broader Salesforce token campaign. - **Impact:** Affected <1% of customers; data such as contact details, IDs, and account numbers exposed. No fund loss or password compromise reported. - **Lesson:** Even carefully regulated financial firms can be undermined by smaller, less visible software dependencies. - **Source:** [**Read More**](https://www.infosecurity-magazine.com/news/wealthsimple-confirms-data-breach/?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=september-recap-the-breach-report) --- ### 4\. Cloudflare (USA / Global SaaS) - **What happened:** As part of the Salesloft/Drift OAuth token attack, Cloudflare’s Salesforce instance was breached, exposing customer support data, API tokens, and internal information. - **Impact:** Sensitive support ticket content, credentials, and internal metadata became exposed. - **Lesson:** SaaS firms are on the front lines of token-based threats — continuous monitoring and least privilege controls are critical. - **Source:** [**Read More**](https://gbhackers.com/cloudflare-confirms-data-breach/?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=september-recap-the-breach-report) --- ### 5\. Workiva (USA / SaaS) - **What happened:** Attackers compromised Workiva’s systems via the same Salesforce supply-chain exploit, accessing contact records and internal case data. - **Impact:** Business contacts, support cases, and internal correspondence were stolen. - **Lesson:** Even sensitive enterprise-software providers are vulnerable to third-party token misuse. - **Source:** [**Read More**](https://www.bleepingcomputer.com/news/security/saas-giant-workiva-discloses-data-breach-after-salesforce-attack/?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=september-recap-the-breach-report) --- ### 6\. WestJet (Canada / Airline) - **What happened:** WestJet admitted that some passenger information was exposed in a breach from earlier this year. - **Impact:** Passenger data (names, contact info) was exposed. No payment data involved. - **Lesson:** The travel and airline sectors remain high-value targets, especially when vendor systems touch customer data. - **Source:** [**Read More**](https://www.reuters.com/sustainability/boards-policy-regulation/canadas-westjet-says-some-passenger-data-exposed-cybersecurity-breach-2025-09-29/?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=september-recap-the-breach-report) --- ### 7\. DraftKings (USA / Gaming / Sports) - **What happened:** On September 2, DraftKings warned customer accounts may have been accessed via credential stuffing or brute-force attacks, though their systems were not directly breached. - **Impact:** Names, contact info, phone numbers, DOBs, partial payment card digits, and account activity could be exposed. - **Lesson:** Credential reuse and weak login defenses continue to be easy gateways into auxiliary data. - **Source:** [**Read More**](https://www.techradar.com/pro/security/draftkings-warns-users-they-may-be-hit-by-cyberattacks-following-breach?utm%5Fsource=unlocked.everykey.com&utm%5Fmedium=referral&utm%5Fcampaign=september-recap-the-breach-report) --- ## 🖥️ Industry Highlights: What’s in the Hot Seat - **Token & OAuth weaponization** — the Salesloft/Drift exploit remains the top vector for cascading breaches. - **Vendor domino effects** — when one SaaS service falls, many downstream are at risk. - **Vendor governance matters** — HR, fintech, airline vendors all surfaced in September. - **Credential hygiene still critical** — DraftKings reminds us that account-level security remains a first line of defense. --- ## 🛡️ Pro Tips & Tools - Rotate and limit token scopes; enforce token expiration and anomaly alerts. - Contractually require immediate vendor notifications and breach escalation protocols. - Adopt zero-trust principles across SaaS integrations. - Monitor for credential abuse, brute force, and account anomalies continuously. - Encrypt vendor-facing data flows and limit external system access. --- ## ⚠️ Emerging Threats to Watch - **OAuth reuse & lateral token escalation** — threat actors are increasingly chaining tokens across systems. - **Supply-chain cascade risk** — one vendor’s breach can ripple across multiple industries. - **Credential stuffing / account hijack** — still a top vector for attackers in 2025. - **Regulated sectors as soft targets** — airlines, fintech, HR systems all entered the breach map this month. --- ## 💡 Final Thoughts September emphasized what many already suspected: **your weakest SaaS integration or vendor connection may be the pathway attackers choose.** From Volvo’s HR vendor compromise to the Stellar fallout from token misuse, the balance of power is shifting. Defending your perimeter is no longer enough — securing every touchpoint, token, and integration in your ecosystem is now the mandate. **Stay vigilant, and we’ll bring you the October report next month.**