Welisa | How Do I Know If My Organization Has Been the Victim of a Hack?

With the upcoming security update for ‘Connected Apps’, Salesforce is taking an important step to counter social engineering. In our main article, we explained which actions you need to take now to prepare for this.

Still, you might be wondering: “Have we already been vulnerable in the past?” In this guide, we’ll take away that uncertainty. Here, we’ll show you exactly how you can check if your organization has been the victim of a hack.

Here is a step-by-step plan, from the most direct to more general investigative methods:

1. Direct Check: Auditing 'Connected Apps' (Most Important)

This is the most direct way to investigate this specific vulnerability. An attacker leaves the clearest tracks here.

Go to: Setup > Connected Apps OAuth Usage.
What to look for:
- Unknown or suspicious apps: Look for apps you don’t recognize, especially those with generic names like “Salesforce API Access,” “Data Loader V3,” or other tools not officially implemented by your organization. A malicious app will often masquerade as a legitimate tool.
- Unexpected “User Count”: Click on the number of users (User Count) for each suspicious app. Is a user who normally doesn’t export data (e.g., a marketing employee) suddenly authorizing an unknown ‘data tool’? That’s a red flag.
- Check the authorization date: When did the user first grant access to the app?
- Block immediately: Any app you don’t 100% trust can be blocked instantly from this page (Block) to prevent further access.

If an attacker gains access via an app, it is often logged as a normal login.

Go to: Setup > Login History.
What to look for:
- Location and IP Address: Are there user logins from unusual countries or IP addresses?
- Application: The Application column shows which app was used to log in. If one of the suspicious apps from step 1 is listed here, it is a strong indicator of misuse.
- Time: Logins in the middle of the night or on weekends by users who typically only work during business hours.

3. Look for Traces of Large-Scale Data Export

This is a more advanced step that often requires extra tools, but it can reveal the impact of an attack.

Tool: If your organization has Salesforce Shield, use Event Monitoring.
What to look for:
- ‘Report Export’ Events: Look for a spike in the number of exported reports. An attacker will often try to download a large amount of data in a short time via reports.
- ‘API Events’: An unusually high number of API requests from a single user or app, indicating a systematic data download.
- Without Shield: Manually check the Last Run Date of important reports containing sensitive customer data. Has a report been run recently by an unexpected user?