Hacker News Reader

Comment by londons_explore | Hacker News Reader

Presumably this should cause most companies in the EU to announce, within 72 hours, a data breach, since it allows any salesforce user to gain any permissions and view/leak/copy/steal any data on any customer in the org.

That will be a lot of companies considering pretty much every big company uses salesforce.

View on HN

While many companies were affected by downtime, only those that were using or had previously used Pardot were affected by the permissions issue.

Doesn't seem to be true, going by the Reddit discussion.

Potentially, everyone that happens to share a instance with an org that has every used Pardot is affected.

I have no inside knowledge but I’m a contract developer on the Salesforce platform so I was on a lot of the public calls today.

Every org on an instance that had an org that used Pardot (huge percentage) had a service outage today.

The security breach was limited to the actual orgs (much smaller percentage) that have actually enabled Pardot in the past.

So, many (I’d guess half) of Salesforce's customers were affected with an outrage, but a much smaller percentage also had a possible data breech.

Does it count as a data breach if unauthorized users were allowed to access data, but they didn't actually? ie. server logs showed that nobody actually read anything they weren't supposed to.

I’m not aware of access logs exist, perhaps history tracking if enabled on that object(limited to 10 fields per object).

It would absolutely be considered a breach if customer data was accessible by non authorized staff, moreso if by partners.

Salesforce has a feature called Event Monitoring. Event monitoring does show lots of information, like pages access, reports exported, api endpoints used, etc. but it needs to be purchased. However, Salesforce does track and retain that data for some time so you can decide to purchase it retroactively if you ever want.

TIL, thanks. Maybe they ought to give that away to those who have an affected org.

EU definition of a personal data breach.

> "‘personal data breach’ means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed;

Based upon this definition just allowing the access is a breach.

Well it seems like a gray area. There's a meaningful difference between "accessing" something and "having access to" something. To me this seems like it would only cover the former.

> Presumably this should cause most companies in the EU to announce, within 72 hours, a data breach, since it allows any salesforce user to gain any permissions and view/leak/copy/steal any data on any customer in the org.

Presumably most users already have an NDA signed? Doesn't that cover PII?

NDA can be breached. What matters if the data was leaked or not, not if it was done legally (Data breaches seldom are)

Reply on news.ycombinator.com