Catograph[.]Net

For the uninitiated: Imagine being a guest at a hotel with great friends. Everyone decides to go outside to enjoy a wonderful time at the pool. Meanwhile, the hotel is responsible for ensuring the security of guest rooms. The manager stores all room keys in a locked drawer and only permits certain employees to access them after guests show proper ID. Unfortunately, there's only one employee manning the front, and they decide to go on an extended lunch break. They leave their key on a hook behind the counter, visible to anyone walking by.

A man with ill intent walks in and approaches the desk, wondering: why is nobody here? No matter. He hops over the counter and swipes the key from its hook. He then unlocks the drawer and starts shoveling all the room keys into a duffel bag. Heading out back, he meets with several associates and hands out the room keys, instructing them to try as many of the keys as possible to steal luggage from the unguarded hotel rooms. Later, in a secure location, the group opens the loot and finds contact information on all their victims. One by one the victims are contacted, and a ransom is demanded: pay us, or you will never see your prized possessions ever again, and your data will be sold online.

A similar situation (replace hotel with Salesloft Drift and the guests as their customers) is what led to the theft of 1.5 billion Salesforce records (Abrams, 2025). A question may come to mind: how did nobody notice the thief take all the keys to then access and steal all those records? It's not necessarily the hotel guests' fault. They were enjoying the pool and had faith that the hotel would take care of them. This is an example of what happens when security controls fail and result in a domino effect: not only does the hotel suffer, but the guests do as well.