Quick answer for busy security teams: as of July 16, 2025 Secureframe has not published a customer-facing breach disclosure or security incident notice. Customers should treat the current SaaS threat environment as high risk, audit integrations and OAuth connections, rotate tokens, and verify monitoring and incident response workflows now rather than later.

Context and why people are asking

June 2025 brought a wave of social engineering attacks that abused Salesforce connected app workflows to install malicious versions of Data Loader and similar tools. Adversaries used voice phishing to trick employees into authorizing apps or entering one-time connection codes, then exported CRM data and in some cases used that foothold to move into other cloud services. This class of attack is notable because it bypasses traditional platform vulnerabilities and relies on human trust to create persistent access.

What Secureframe has said and what we can confirm

Secureframe’s public channels through mid July 2025 show product updates, research and compliance guidance but no statement that the company itself experienced a security incident. Secureframe’s Data Processing Agreement also outlines incident notification and customer audit rights, meaning customers have contractual ways to ask for details if an incident affects their data. If you need a formal confirmation, use the DPA notice and your Secureframe account contacts to request an incident status update.

Why Secureframe customers should still be concerned

Not every problem is a vendor breach. The big risk vector in mid 2025 is integrations and delegated access. Even if Secureframe itself is uncompromised, customers who link multiple SaaS products, identity providers, ticketing systems, or CRMs face elevated supply chain risk. A compromised CRM, ticketing tool, or stolen OAuth token anywhere in your stack can be used to escalate into other services or to harvest audit artifacts and evidence. Treat vendor ecosystems as part of your attack surface.

Concrete checklist for Secureframe customers and similar SaaS users

1) Audit connected apps and OAuth clients now. List every connected app in Salesforce, Okta, Zendesk, and other platforms. Remove or suspend anything unrecognized. Lock who can approve new connected apps to a small admin group.

2) Rotate tokens and client secrets. Revoke long-lived OAuth refresh tokens and client secrets for integrations you cannot immediately verify. Issue new credentials using constrained scopes and shorter lifetimes. Monitor for reuse of old tokens. (If you use Secureframe integrations such as Zendesk or ServiceNow, review those connections and rotate keys there too.)

3) Enforce least privilege and MFA. Restrict service accounts and integration roles to only the scopes required. Ensure human accounts that can approve apps or tokens require strong MFA and limit their ability to approve connected apps.

4) Hunt for indicators of unauthorized connected apps and anomalous exports. Search logs for new connected app installations, unexpected bulk exports, unusual API client IDs, or access from unfamiliar IP ranges. If you have SIEM or SOAR, create a playbook to automatically alert on those behaviors.

5) Validate your evidence collection and incident playbooks. Secureframe customers should verify that their compliance evidence and incident tickets are not writable by low-privilege integrations. Confirm your incident response runbooks cover supply chain and delegated access scenarios and map to Secureframe’s evidence and incident tracking capabilities.

6) Use contractual levers. If you suspect any vendor compromise, invoke DPA incident notification clauses and request forensic statements, timelines, and scope of affected data. Document all requests and responses for audit and regulatory needs.

Triage guidance if you suspect you were exposed via a connected app

1) Immediately revoke the suspected connected app and its tokens. 2) Export logs for the window of suspected access and preserve them in an immutable store. 3) Rotate service credentials and any downstream secrets that the actor could have collected. 4) Run targeted searches for suspicious exports or lateral movement into identity providers, ticketing, or cloud consoles. 5) Engage your forensics partner and notify stakeholders per your regulatory obligations. These steps are standard but essential and should be executed in that order to limit further exposure.

Longer term controls worth investing in

  • Approve-only connected app policies and admin-only installation for high-risk apps. - Using External Client Apps or dedicated client IDs for desktop tools to avoid shared client IDs that can be impersonated. - Shorter lived tokens, token introspection, and oauth client allow lists. - Continuous monitoring for anomalous API behavior and rapid token revocation capabilities. - Regular tabletop exercises that include delegated access and supply chain compromise scenarios. Many of these controls are practical and low friction compared with the cost of a post-incident response.

Bottom line

As of July 16, 2025 there is no public Secureframe breach notice. That does not equal safety. The mid 2025 trend is clear: attackers are weaponizing delegated access and human trust to harvest data from SaaS platforms, then monetizing or pivoting from that foothold. If you run Secureframe or any SaaS that integrates broadly, act now on the checklist above. Do not wait for vendor confirmation. Protect your integrations, rotate credentials, tighten approvals, and validate your detection and response playbooks today.