Coca-Cola data leaks expose how identity sprawl fuels breach impact

At a glance

What this is: Two Coca-Cola-related leaks exposed employee identity data and a large Salesforce dataset, illustrating how identity sprawl can turn a breach into a broader governance failure.

Why it matters: IAM, IGA, PAM, and NHI teams should treat exposed personal data, CRM data, and third-party access as one governance problem because weak identity control increases both breach reach and recovery cost.

Context

This article is about identity sprawl as a breach amplifier, not just the volume of stolen data. In one case, employee records from Coca-Cola Gulf were exposed, including passport and residency details; in another, Coca-Cola Europacific Partners data was taken from a Salesforce environment.

The governance gap is straightforward: once identity-linked systems, cloud CRM data, and third-party access paths are loosely controlled, a single compromise can surface both personal and operational records. For IAM and NHI programmes, the question is not only who had access, but how far that access could travel across business systems.

Key questions

Q: What breaks when identity sprawl is not controlled in cloud and CRM environments?

A: Identity sprawl breaks containment. When users, partners, service accounts, and SaaS permissions accumulate without coordinated lifecycle control, a single compromise can expose employee records, customer data, and operational systems at the same time. The practical failure is not only stolen data, but the loss of boundary between one access path and many sensitive datasets.

Q: Why do Salesforce environments create more data exposure risk than many security teams expect?

A: Salesforce concentrates customer records, attachments, case threads, and exports in one system that is heavily used by users and integrations. That combination creates blind spots for traditional controls because activity happens through browsers, APIs, partner sharing, and mobile access. Risk grows when sensitive data is shared externally or exported without content-aware enforcement.

Q: What are the signs that a third-party access breach is in progress?

A: Common warning signs include logins from suspicious IP addresses, repeated 401 and 403 responses, abnormal authentication patterns in vendor logs, and outbound connections to known malicious domains. Security teams should correlate these signals with access history and data movement. A single anomaly may be noise, but several together often indicate credential abuse or active exfiltration.

Q: How should security teams split identity governance from implementation work?

A: Security teams should use governance forums to define acceptable risk, ownership, and access policy, then use engineering forums to turn those decisions into workflows, APIs, and enforcement. The key is to keep both connected through shared control objectives so that policy, automation, and audit evidence line up across the identity programme.

Technical breakdown

Why identity sprawl turns one compromise into many exposures

Identity sprawl means access, accounts, and data paths grow faster than governance can keep them aligned. In this case, exposed employee records and a Salesforce dataset point to a control environment where identity, application access, and downstream business data were not contained within a tight boundary. The problem is not simply that data existed in multiple systems. It is that the same access model likely made those systems reachable through overlapping privileges, third-party relationships, or weak lifecycle discipline. Practical implication: breach impact expands when identity boundaries are broader than the data they protect.

Practical implication: Map which identities can reach regulated personal data, CRM records, and administrative datasets, then reduce cross-system privilege overlap.

Why Salesforce environments attract identity-driven breach activity

Cloud CRM platforms concentrate customer, employee, and case data in one place, which makes their authentication and authorisation model high value. When attackers or leak actors reach Salesforce data, they often do so through compromised access, overextended permissions, or exposed connected applications rather than by attacking the database directly. That is why Salesforce is not just an application risk. It is an identity risk with data consequences. Practical implication: CRM access should be governed as a sensitive identity surface, not only as an application configuration issue.

Practical implication: Review Salesforce roles, connected apps, and service access as part of privileged access and lifecycle governance.

How third-party and regional operating models widen breach impact

The Coca-Cola Gulf leak shows how regional distributors, local employment records, visa documents, and payment details can sit inside a broader enterprise identity perimeter without behaving like a single system. That creates a mismatch between corporate governance and operational reality. If vendor, distributor, or regional access is not offboarded, segmented, and recertified with the same discipline as internal access, the breach surface becomes much larger than the primary environment. Practical implication: identity governance must follow the operating model, not just the corporate org chart.

Practical implication: Apply the same access review and offboarding standards to distributors, regional offices, and shared service identities as to internal users.

Threat narrative

Attacker objective: The objective was to monetise and publicise high-value identity and CRM data by turning internal access into externally saleable breach material.

1. Entry occurred through access to a Coca-Cola Gulf environment and a separate Coca-Cola Europacific Partners Salesforce environment, both of which contained sensitive business and identity-linked data.
2. Credential or account abuse enabled the actor to extract employee records, passport data, and CRM content rather than only a small, isolated dataset.
3. Escalation manifested in the breadth of the exposed material, including 1,104 files in the Gulf case and 64 gigabytes of Salesforce data in the CCEP case.
4. Impact included identity theft, fraud, phishing exposure, operational disruption, and reputational damage across multiple business units and regions.

Breaches seen in the wild

• Salesloft OAuth token breach: hackers stole OAuth tokens to access Salesforce data via Salesloft.
• Klue OAuth Supply Chain Breach: OAuth tokens compromised in Klue integration breach affecting 700+ organisations via Salesforce data access chain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Identity sprawl is the real breach multiplier here: the damage is not limited to what was stolen, but to how many identity and business systems were reachable once the initial access path existed. When employee records, regional HR documents, and Salesforce data sit under different teams but weakly aligned governance, breach impact compounds quickly. Practitioners should treat cross-system reachability as a core control objective, not a by-product of user access.

Salesforce access has become an identity control surface, not just a SaaS admin task: CRM platforms concentrate personal data, support records, and operational context in ways that make entitlement design and connected-app governance decisive. The breach pattern suggests that authorisation scope, not merely application hardening, determines whether a compromise stays contained. IAM teams need to evaluate CRM access with the same discipline they apply to privileged systems.

Third-party and regional access models are where breach containment often breaks down: distributor relationships, local employment processes, and shared operational systems can create access that outlives its business purpose. That is especially dangerous when identity reviews are built around headquarters assumptions rather than local operating realities. The practical conclusion is that lifecycle governance has to follow business dependency chains, or it will miss the identities most likely to expand breach impact.

Data exposure and identity exposure are now inseparable governance problems: once identity records, passport data, and customer or support data coexist in the same access universe, the programme must govern them together. This is a classic case of identity blast radius, where one weak entitlement can surface multiple regulated data classes at once. Practitioners should redesign controls around reachability and consequence, not around system silos.

Identity blast radius: this is the point at which a single access failure exposes several data classes, business units, or regional operations at once. The Coca-Cola cases show that the blast radius grows when entitlement scopes, distributor access, and CRM permissions are not reviewed as one chain. For governance teams, that means breach readiness starts with mapping who can reach what, and why.

What this signals

Identity blast radius: breach containment should now be measured by how many data classes a single access path can reach, not by how many systems are formally segmented. When employee records, regional HR material, and CRM data are governed separately, the organisation often discovers too late that the permissions were not separate at all.

The programme signal for IAM teams is to stop treating SaaS administration, partner access, and regional operational access as different governance problems. In practice, they are the same lifecycle problem with different data outcomes, and that means recertification, offboarding, and entitlement design must be evaluated across all three at once.

For practitioners

• Map cross-system identity reachability Identify which users, contractors, regional offices, and third parties can traverse from one business system into employee records, CRM data, and support cases. Use that map to remove unnecessary overlap between access paths.
• Review Salesforce entitlements as privileged access Treat CRM roles, connected applications, and administrative permissions as high-value access that requires periodic recertification and tighter approval than ordinary SaaS use.
• Apply lifecycle controls to regional and distributor access Revalidate local identities, shared accounts, and partner access on the same schedule used for internal employees, especially where payroll, visa, passport, or case data is present.
• Segment identity data from operational data Separate storage, access policies, and logging for passport details, employee records, and customer case data so one compromise cannot reveal all three at once.

Key takeaways

• The incident pattern shows that identity sprawl can turn a contained compromise into a multi-system exposure involving employee, partner, and CRM data.
• The article describes two separate leaks, including one case with 64 gigabytes of Salesforce data and another involving 959 employee records, showing how quickly breach scope can grow.
• The most relevant control lesson is to govern access paths, lifecycle offboarding, and third-party reachability as one programme rather than as isolated security tasks.

Key terms

• Identity Sprawl: Identity sprawl is the uncontrolled growth of identities, entitlements, and credentials across an environment. For NHIs, it usually appears when automation creates accounts faster than governance teams can inventory, review, and remove them. The result is hidden access, weak accountability, and a wider attack surface.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.
• Third-Party Identity: An identity issued to a partner, vendor, contractor, or external service that can access internal systems. These identities often sit outside normal employee governance and can become persistent trust paths if they are not reviewed, expired, and revoked on schedule.
• Salesforce entitlement drift: The gradual misalignment between a user’s current role and the access they still hold in Salesforce. It usually appears when onboarding, role changes, and offboarding are handled in different workflows, leaving permissions, groups, or divisions in place after they no longer match business need.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.