A major data breach at an outside vendor that partners with Salesforce has affected hundreds of companies, including some of the largest in the tech industry. While this was a significant security event, JMP was not impacted, and we experienced no interruption to our business operations.
This successful outcome was thanks to the proactive and rapid response of our internal Salesforce team. After the breach, Salesforce announced a security cutoff date of Sept. 2, requiring all app integrations to be updated. JMP's Salesforce team received the necessary information on Thursday, Aug. 28, and had only two business days to secure all 50+ of our integrations, including business-critical apps like DocuSign, CPQ, and others. They worked tirelessly to complete these updates before the end of the day on Friday, ensuring we were not impacted over the long holiday weekend or when Salesforce cut off access to all the integrations the following Tuesday.
Their swift and diligent efforts not only protected our systems from a potentially catastrophic breach but also ensured that business continued to run smoothly with no visible impact on our customers, My JMP, or the online store. Without their quick action, the breach could have brought our operations to a complete halt.
This was a quiet success story, but a huge win for JMP, highlighting the importance of staying vigilant against social engineering attacks and data breaches.
What we can learn
Last Tuesday, you should have received an email from the JMP Security Team with important information about the increasing risks of social engineering attacks. This incident serves as a crucial reminder that security is a shared responsibility. While our teams are working hard to protect our systems, social engineering attacks—like phishing, pretexting, and baiting—are still a leading cause of data breaches.
These attacks often target individuals to trick them into revealing sensitive information or granting unauthorized access. Criminals use publicly available information to identify and target employees, especially those with access to sensitive customer data, product information, and internal systems.
Here are the key takeaways from the JMP Security Team's message on what to do if you encounter a suspicious attempt:
- Do NOT respond, click links, or forward the message.
- Report immediately to security@jmp.com and submit a Phishing Ticket to SAS Security.
- Always verify requests for sensitive information or external communications before sharing.
The Security Team also noted that social engineering attacks can target anyone, regardless of role or access level. Even accounts with limited privileges can be leveraged by attackers to cause damage.
Staying alert and reporting suspicious activity promptly is critical to protecting you, JMP, and our customers.
Additional help resources
