Skip to content
BreachPathAttack Path LibraryStart
FoundationalData theft

SaaS API token to data theft

A leaked API token for a business SaaS platform is used to access its API directly, enumerate what the token can reach, and export data at scale — bypassing the login and its MFA entirely.

Technologies
SaaS (generic)
Entry points
Stolen credentials, Supplier compromise
Sectors
SaaS & technology, Professional services, Financial services…
Stages
3
01

A leaked API token is used against the platform

An API token is exposed — in code, a config file, a log, or a compromised integration — and the attacker uses it to call the platform's API directly as the token's identity, without ever seeing the login or its MFA.

Attacker objective

Authenticate to the SaaS API with a valid token, avoiding the login UI.

MITRE ATT&CK
Controls that should stop this
  • Short-lived, narrowly-scoped tokens with rotation
  • Secret scanning across code, logs and configs
  • IP allow-listing and per-token rate limits
What defenders should see
  • API calls from a new source IP or region for the token
  • Token use outside its normal integration pattern
  • Secret-scanning alerts for exposed tokens
What a pentest validates
  • Scan for exposed tokens across the estate
  • Review token scope, lifetime and rotation
  • Test whether API access is monitored like interactive login
Business impact

The attacker can call the platform's API with the token's rights.

02

The token's reach is enumerated

The attacker probes the API to understand the token's scope — which records, objects and endpoints it can access — mapping the extent of the data available before pulling it.

Attacker objective

Learn what data and actions the token permits.

MITRE ATT&CK
Controls that should stop this
  • Least-privilege token scopes aligned to the integration's real need
  • Anomaly detection on API enumeration patterns
  • Alerting on access to endpoints the token rarely uses
What defenders should see
  • Broad sweeps across many API endpoints or record types
  • Access patterns inconsistent with the integration's purpose
  • First-seen endpoint access for the token
What a pentest validates
  • Enumerate what each integration token can actually reach
  • Review scope minimisation for tokens
  • Validate detection of API enumeration
Business impact

The attacker maps the full extent of data the token exposes.

03

Data is exported at scale via the API

The attacker uses the API's list and export capabilities to retrieve records in bulk, pacing requests to stay under rate limits and blend with legitimate integration traffic.

Attacker objective

Pull the reachable data out through the API.

MITRE ATT&CK
Controls that should stop this
  • Rate limiting and volume alerting per token
  • Data minimisation and field-level access controls
  • Comprehensive API audit logging with monitoring
What defenders should see
  • High-volume list/read/export activity for one token
  • Data pulled far exceeding the integration's norm
  • Egress to unfamiliar destinations
What a pentest validates
  • Test whether a token enables undetected bulk export
  • Validate volume alerting on API reads
  • Confirm API audit logging is complete and monitored
Business impact

Business and customer data is exported through the API — a breach via a channel that is often under-monitored.

ATT&CK techniques in this chain

T1213Data from Information RepositoriesT1552.001Unsecured Credentials: Credentials In FilesT1567Exfiltration Over Web ServiceT1550.001Use Alternate Authentication Material: Application Access TokenT1526Cloud Service Discovery

If this chain completes

Bulk data loss through a programmatic interface that many organisations monitor far less closely than interactive logins — and which a long-lived token accesses without triggering MFA.

Should you test this against your environment?

Turn this chain into a scoped red-team brief — objective, systems and identities in scope, testing assumptions and the questions to answer before commissioning.

Generate my red-team test briefExplore more paths