The Breach Between the SaaS: Why Secure Integrations Must Be Engineered, Not Assumed

When a major brand announces a breach, the headline often stops at the name on the badge, not the weakness in the architecture. The latest disclosure from Stellantis, the global automaker behind Chrysler, Jeep, Dodge, and Ram, follows a familiar pattern: a third-party platform supporting North American customer service operations was compromised, exposing customer contact information. The company notified the authorities and affected individuals, urging them to remain vigilant against phishing. While the category of data involved limits the immediate impact, the lesson is broader than any single incident. The infrastructure connecting systems has become critical infrastructure. If that fabric is not engineered, operated, and governed with the same rigor as application code, it will remain a soft target for threat actors.

Stellantis’ statement on the breach was measured, but also a familiar story in the current era of breach disclosures. “We recently detected unauthorized access to a third-party service provider’s platform that supports our North American customer service operations. Upon discovery, we immediately activated our incident response protocols, initiated a comprehensive investigation, and took prompt action to contain and mitigate the situation. We are also notifying the appropriate authorities and directly informing affected customers.”

While the breach has been revealed as part of an integration, the event itself adds to the piling evidence that integration development and management needs to change. Regardless of whether the integration supports customer interaction, go-to-market workflows, or critical infrastructure, time and time again, the space between the products enterprises rely on continues to be targeted due to poor security, unpatched vulnerabilities, or exposed API credentials.

Over the past several weeks, multiple investigations and advisories have described a broader campaign abusing OAuth tokens and connected app permissions across integrations to Salesforce customer environments. Google’s Threat Intelligence Group has detailed the activity of an actor they track as UNC6395, including the theft and misuse of OAuth tokens associated with Salesloft’s Drift and Drift Email integrations. The FBI’s public FLASH likewise warns about two clusters, UNC6040 and UNC6395, and urges tightened controls around third-party connected apps, enforced rotation of tokens, and active hunting for anomalous API behavior.

Even though the victims differ, the pattern is consistent: attackers are not breaking through obscure zero-days in core platforms so much as walking the hallways with borrowed badges that were too broad, too long-lived, or too loosely monitored. In other words, this is less a single-vendor flaw and more a governance gap in the integrated ecosystem that enterprises are relying on.

That distinction matters because it shifts the remedy from “wait for the vendor to patch” to “raise the engineering standard for integrations you approve and operate.”

Integrations now behave like privileged users. They review customer records, initiate workflows, and transfer data to analytics stores. If they are not treated as first-class software with owners, version history, test coverage, and rollback plans, the seams between tools will continue to tear under load. If their tokens are not short-lived and least-privileged by default, the impact of a stolen credential will remain larger than it needs to be. If the integration’s behavior is not observable end-to-end, the time to detect, contain, and recover will continue to be measured in days rather than disciplined minutes.

This is not an argument for eliminating integrations.  The need for these across security and IT is real, as teams work with an ever-increasing set of products that rely on input from other systems. Instead, this is an evidence-based call to action for enabling the company to scale with a security mindset. Integrations built and operated with explicit ownership, scoped access, comprehensive logging, and rapid revocation give teams the confidence to move faster because the cost of a mistake is bounded, the audit trail is intelligible, and the recovery path is practiced.

That discipline is how leaders convert security from a tax into a growth enabler. Scalability depends on trustworthy integrations that are built and maintained by a team dedicated to its security and reliability. Peace of mind depends on knowing that if an integration is misused, the integration management team can identify the issue, limit the damage, and shut the door without disrupting mission-critical workflows downstream.

While not easy to implement overnight, the practical path forward is to build integrations like products, not projects. Assign owners who have the authority to change scopes and the responsibility to attest that those scopes remain justified. Prefer short-lived tokens and narrowly granted permissions, and encourage vendors to provide them where they do not yet exist. Invest in observability that correlates non-human identities to any activity in a way responders can trust under pressure. Practice revocation as a muscle, not a myth, and report “time-to-revoke” alongside patch windows and MFA adoption. Treat missing logs as control failures, evergreen credentials as exceptions to be eliminated, and undocumented connections as incidents waiting for timing. Finally, ensure that integrations are always up-to-date, using the latest APIs from each of the vendors integrated.

The Stellantis disclosure is yet another reminder that security promises can break at the seams if the underlying engineering is not done correctly. The good news is that the fix is within reach. When integrations are designed, maintained, and governed with a security mindset, owned, least-privileged, observable, and revocable, organizations minimize the marginal risk of the next connection, compress incident timelines from days to hours, and preserve continuity even when something goes wrong. The better headline is not that the industry will never have another breach, but that the following statement can truthfully be added: we contained the exposure in minutes because every integration was scoped, logged, maintained, and revocable by design.