A security breach at a SaaS integration vendor led to the theft of authentication tokens, impacting over a dozen companies with data theft incidents.

Stolen tokens were used to target multiple cloud storage and SaaS providers, with Snowflake’s cloud data platform being the primary target for data theft, according to BleepingComputer.

Snowflake acknowledged “unusual activity” to BleepingComputer and confirmed that a limited number of their clients were affected.

Snowflake informed BleepingComputer that they recently identified unusual activity within a few customer accounts connected to a particular third-party integration.

They immediately began an investigation, secured potentially affected customer accounts as a precaution, and alerted impacted customers with guidance on enhancing their account protection, Snowflake added.

Snowflake emphasized that their systems were not vulnerable or compromised in the attacks.

Reports indicate that the attackers attempted unsuccessfully to use the stolen authentication tokens to extract data from Salesforce, but they were detected before they could succeed.

Although Snowflake didn’t specify the third-party integration partner involved, multiple sources informed BleepingComputer that the attacks originated from a security issue at Anodot, a data anomaly detection firm.

Anodot, an AI-driven analytics firm, provides real-time anomaly detection for business and operational data, assisting organizations in automatically detecting unusual changes in revenue, transactions, and system performance using machine learning. Glassbox, a data analytics company, acquired Anodot in November 2025.

BleepingComputer learned that the ShinyHunters extortion group is now attempting to extort numerous companies, demanding ransom payments to prevent data leaks.

The ShinyHunters group claimed responsibility for the attacks to BleepingComputer, stating that they had stolen data from dozens of companies the previous Friday and that their Salesforce data theft attempts were thwarted by AI detection.

The foiled attempt occurred amid a series of data breaches over the past year aimed at Salesforce customers.

The attackers also claimed that the security problem at Anodot was the source of the attack, implying they had been able to access the company’s systems for a while.

The threat actor revealed some of the companies supposedly impacted by the incident, but BleepingComputer will not share them without confirmation.

Payoneer was the only company to respond to BleepingComputer’s inquiries, stating they were aware of the integrator breach but not affected by it.

Payoneer stated to BleepingComputer that they are aware of a security incident involving Anodot, a third-party service provider, and their review shows that Payoneer was not affected.

Google’s Threat Intelligence Group confirmed to BleepingComputer that it is aware of the incident and is tracking it, but had nothing further to share; this group has been following many of this year’s data theft campaigns.

BleepingComputer has contacted Anodot and its parent company, Glassbox, multiple times via email without receiving a response.