Incident Types: The types of cybersecurity incidents that have occurred include Cyber Attack and Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with mandatory multifactor authentication, and third party assistance with push security (browser security platform), and containment measures with browser-based detection/response (push security), containment measures with oauth app permission audits (salesforce), containment measures with extension blacklisting/removal, containment measures with mfa enforcement (eliminating ghost logins), and remediation measures with sso/mfa coverage expansion, remediation measures with browser extension whitelisting, remediation measures with user training (phishing, clickfix awareness), remediation measures with endpoint monitoring (malicious file downloads), and enhanced monitoring with browser-level activity logging (push security)..

Common Attack Types: The most common types of attacks the company has faced is Breach.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through Third-party contractor's employee, Phishing Links (Email, SMS, Social Media and Ads)Malicious OAuth Apps (Device Code Flow)Compromised Browser ExtensionsFake CAPTCHA/Error Pages (ClickFix)Malvertising (Drive-by Downloads).

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Customer credentials, Credentials (Snowflake, Salesforce, Jira), Session Tokens (Stolen Via Infostealers), Oauth Tokens (High-Risk Permissions), Pii (From Browser Caches, Extensions) and .

Third-Party Assistance: The company involves third-party assistance in incident response through Push Security (Browser Security Platform), .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: mandatory multifactor authentication, , SSO/MFA Coverage Expansion, Browser Extension Whitelisting, User Training (Phishing, ClickFix Awareness), Endpoint Monitoring (Malicious File Downloads), .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by browser-based detection/response (push security), oauth app permission audits (salesforce), extension blacklisting/removal, mfa enforcement (eliminating ghost logins) and .

Key Lessons Learned: The key lessons learned from past incidents are Browsers Are the New Attack Surface: Traditional email/endpoint security is insufficient for modern, decentralized work environments.,Multi-Channel Threats Require Unified Visibility: Attacks span email, SMS, social media, and in-app messages, necessitating cross-channel detection.,OAuth Abuse is a Blind Spot: Malicious app integrations bypass MFA and traditional authentication controls (e.g., Salesforce device code flow).,Extensions Pose Significant Risk: Unvetted extensions can silently exfiltrate credentials and session data (e.g., Cyberhaven hack).,MFA Gaps Persist: Ghost logins and unmanaged SaaS apps create backdoors for credential stuffing.,Browser-Native Defenses Are Critical: Real-time monitoring of browser activity (logins, downloads, extensions) is essential for early detection.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Category: User Awareness, , Category: Endpoint & Network, , Category: Identity Hardening, , Category: Vendor Collaboration, , Category: Detection & Prevention and .

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: Push Security - Browser-Based Attack OverviewUrl: https://www.pushsecurity.com/product-overview, and Source: Snowflake Customer Breaches (2023), and Source: Salesforce OAuth Attacks (2024), and Source: Cyberhaven Extension Hack (December 2024), and Source: Jira Credential Stuffing Attacks (2024).

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Users Of Snowflake, Salesforce, Jira, And Other Saas Platforms Should:, - Reset Passwords And Revoke Oauth App Permissions., - Enable Mfa (Preferably Phishing-Resistant)., - Audit Browser Extensions And Remove Unrecognized Ones., - Monitor For Unusual Login Activity (E.G., Via Sso Logs). and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Push Security (Browser Security Platform), , Browser-Level Activity Logging (Push Security), .

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Adopt Browser-Centric Security: Tools Like Push Security To Detect/Block In-Browser Threats., Implement Zero Trust For Saas: Continuous Authentication And Least-Privilege Oauth Permissions., Enforce Extension Policies: Whitelist Approved Extensions And Block Side-Loading., Monitor For Anomalous Logins: Use Browser/Sso Logs To Detect Ghost Logins And Credential Abuse., Collaborate With Saas Providers: Advocate For Better Oauth Controls And Customer-Side Monitoring Apis., .

Last Attacking Group: The attacking group in the last incident was an ShinyHunters.

Most Significant Data Compromised: The most significant data compromised in an incident were Customer credentials, hundreds of millions of records, , Credentials (Usernames, Passwords, Session Tokens), Business App Data (Snowflake, Salesforce, Jira), PII (From Infostealers, Browser Cache), OAuth Tokens (High-Risk Permissions) and .

Most Significant System Affected: The most significant system affected in an incident were Web Browsers (Chrome, Edge, Firefox, Safari)SaaS/Cloud Apps (Salesforce, Snowflake, Jira, Others)Endpoints (Windows, macOS via Terminal Commands)Identity Providers (SSO, MFA Bypass).

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was push security (browser security platform), .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident was Browser-Based Detection/Response (Push Security)OAuth App Permission Audits (Salesforce)Extension Blacklisting/RemovalMFA Enforcement (Eliminating Ghost Logins).

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were OAuth Tokens (High-Risk Permissions), Credentials (Usernames, Passwords, Session Tokens), PII (From Infostealers, Browser Cache), hundreds of millions of records, Business App Data (Snowflake, Salesforce, Jira) and Customer credentials.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 0.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was Browser-Native Defenses Are Critical: Real-time monitoring of browser activity (logins, downloads, extensions) is essential for early detection.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Category: User Awareness, , Category: Endpoint & Network, , Category: Identity Hardening, , Category: Vendor Collaboration, , Category: Detection & Prevention and .

Most Recent Source: The most recent source of information about an incident are Push Security - Browser-Based Attack Overview, Jira Credential Stuffing Attacks (2024), Cyberhaven Extension Hack (December 2024), Salesforce OAuth Attacks (2024) and Snowflake Customer Breaches (2023).

Most Recent URL for Additional Resources: The most recent URL for additional resources on cybersecurity best practices is https://www.pushsecurity.com/product-overview .

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (Salesforce, Other SaaS Attacks).

Most Recent Customer Advisory: The most recent customer advisory issued were an Users of Snowflake, Salesforce, Jira, and other SaaS platforms should:- Reset passwords and revoke OAuth app permissions.- Enable MFA (preferably phishing-resistant).- Audit browser extensions and remove unrecognized ones.- Monitor for unusual login activity (e.g. and via SSO logs).

Most Recent Entry Point: The most recent entry point used by an initial access broker was an Third-party contractor's employee.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Lack of multifactor authentication, Over-Reliance on Perimeter Security: Email/network controls fail to stop browser-based attacks.Lack of Browser Visibility: Security teams cannot detect in-browser threats (phishing, ClickFix, extensions).Decentralized Identity Management: Unmanaged SaaS apps and ghost logins create MFA gaps.User Trust Exploitation: Attackers abuse legitimate browser functions (OAuth, copy-paste, extensions).Obfuscation Techniques: Dynamic code, CAPTCHA bypasses, and SaaS hosting evade traditional defenses..

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Adopt Browser-Centric Security: Tools like Push Security to detect/block in-browser threats.Implement Zero Trust for SaaS: Continuous authentication and least-privilege OAuth permissions.Enforce Extension Policies: Whitelist approved extensions and block side-loading.Monitor for Anomalous Logins: Use browser/SSO logs to detect ghost logins and credential abuse.Collaborate with SaaS Providers: Advocate for better OAuth controls and customer-side monitoring APIs..