In early 2025, a sophisticated cyberattack targeted Salesloft, a sales engagement platform, and Drift, a conversational marketing company. The attackers began by compromising Salesloft’s GitHub account, where they downloaded source code and created rogue CI/CD workflows. This allowed them to escalate privileges and pivot into Drift’s AWS environment, where they discovered and exfiltrated OAuth tokens used to integrate with platforms like Salesforce, Slack, and Google.

These stolen tokens were then used to access Salesforce support cases across dozens of companies, including Cloudflare, Zscaler, Palo Alto Networks, and Proofpoint. In some cases, attackers accessed sensitive credentials like API keys, AWS secrets, and Snowflake tokens, leading to a widespread supply chain compromise.

🚨 The Impact

• Over 20 major companies affected
• OAuth tokens stolen and reused to access sensitive data
• Salesforce instances compromised via legitimate-looking API calls
• GitHub and AWS environments abused for lateral movement

🛡️ How RinTech Protects Your Business

At RinTech, we help businesses proactively secure their development environments through tailored consulting and project-based engagements. Here’s how we help prevent attacks like this:

🔄 Migrate Away from GitHub

We assist in migrating your code repositories from GitHub to self-hosted solutions, customized to your infrastructure. This reduces your exposure to public attack surfaces and gives you full control over access and auditing.

🔐 In-House DevOps Security

By managing your DevOps tools in-house:

• You avoid the inherent vulnerabilities of public platforms.
• You gain visibility into every user, commit, and workflow.
• You can enforce VPN-only access to all DevOps tools.

👁️ Endpoint & Network Monitoring

We implement:

• Endpoint monitoring to detect unauthorized repository changes or the creation of new users.
• Network monitoring to flag unusual outbound traffic or API calls to unknown devices — a key indicator of token abuse or data exfiltration.

🧩 Tailored Security Projects

Every client’s infrastructure is different. That’s why RinTech offers custom security project management to:

• Design and deploy secure DevOps pipelines
• Harden cloud and on-prem environments
• Implement secrets management and access controls
• Integrate monitoring tools like Wazuh, Suricata, and Checkmk

Want to know if your current DevOps setup could survive a breach like this?
Contact RinTech Solutions for a security consultation.

In March 2025, DaVita—a major dialysis provider—suffered a ransomware attack that lasted nearly three weeks, from March 24 to April 12, according to Reuters. During this time, attackers gained access to DaVita’s internal lab database, exposing sensitive information including names, addresses, birth dates, medical records, and Social Security numbers of up to 2.7 million patients and users.

The breach was costly—$13.5 million just to restore encrypted data—and devastating in scope. The hacker group Interlock claimed responsibility, stating they exfiltrated over 1.5 terabytes of patient data. According to Fox News, the attackers specifically targeted DaVita’s lab systems, which held highly sensitive patient records.

How Did It Happen?

Based on Interlock’s previous tactics, it’s likely the attackers used phishing emails or compromised websites to trick users into installing a Remote Access Trojan (RAT)—a type of malware that gives attackers full control over the victim’s system. This method, known as a drive-by download attack, often involves a user clicking a seemingly harmless button or link on a compromised site, unknowingly triggering the RAT installation.

Once installed, the RAT enables attackers to:

• Move laterally across the network
• Exfiltrate data silently
• Deploy ransomware payloads

Why Was It Not Detected?

Attacks like this often go unnoticed due to:

• Lack of properly configured SIEM/XDR tools
• Alert fatigue or poor triage in the Security Operations Center (SOC)
• Flat network architecture with no segmentation
• Inadequate user training on phishing and social engineering

How RinTech Solutions Can Help?

At RinTech Solutions, we specialize in defending small businesses against exactly these kinds of threats. Our infrastructure includes enterprise-grade SIEM/XDR and IDS/IPS tools that:

• Monitor system changes in real time
• Detect malicious activity in network traffic
• Alert security personnel to suspicious behavior
• Automatically implement defensive playbooks—like isolating infected devices

We combine this with user training and proactive threat hunting to ensure your business is protected from both known and emerging threats.

Cybersecurity isn’t just for large enterprises. If DaVita—with its resources and scale—can fall victim to a preventable attack, small businesses must be even more vigilant. RinTech Solutions is here to help you stay ahead of the threat curve.

References:
Reuters. (2025). Ransomware attack at DaVita impacted 2.7 million people, US health dept website shows. https://www.reuters.com/business/healthcare-pharmaceuticals/ransomware-attack-davita-impacted-27-million-people-us-health-dept-website-shows-2025-08-21/
Knutsson, K. (2025). Nearly a million patients hit by DaVita dialysis ransomware attack. Fox News. https://www.reuters.com/business/healthcare-pharmaceuticals/ransomware-attack-davita-impacted-27-million-people-us-health-dept-website-shows-2025-08-21/