In May 2020, SAP disclosed security lapses across several of its cloud-based products, including SAP Cloud Platform, SAP Analytics Cloud, SuccessFactors, and Concur. The company identified these issues during an internal security review and initiated remediation efforts for approximately 9% of its 440,000 customers.
Executive Summary
The May 2020 announcement from SAP revealed that specific cloud-based products did not meet certain contractual or statutory security standards. Following an internal audit, SAP began notifying approximately 40,000 affected customers and prioritized remediation to patch the impacted infrastructure by the end of the second quarter of 2020. SAP stated that these findings were not the result of a security incident and maintained that no customer data had been compromised.
To address the situation, SAP updated its security-related terms and conditions for cloud solutions, asserting that the changes were “in line with market peers” rather than an attempt to shift legal liability to customers. The company also clarified that this disclosure was unrelated to the Cloud Hopper hacking campaign, which targeted HPE’s cloud services. While SAP did not disclose the specific nature of the technical flaws, the announcement signaled a period of increased scrutiny regarding the security of digital transformation initiatives as organizations shift from on-premise environments to cloud-hosted SAP applications.
Key Takeaways
- Scope of Disclosure: SAP identified security gaps affecting 9% of its 440,000 customers across multiple cloud products.
- No Breach Reported: SAP confirmed the issues were found via internal review and stated no customer data was compromised.
- Remediation Timeline: Technical fixes for the impacted cloud products were scheduled for completion by the end of Q2 2020.
- Terms Update: SAP revised its security-related terms and conditions, aiming to align them with industry standards.
- Market Impact: Analysts noted the disclosure could increase customer focus on security audits during cloud migrations.
Which products were affected by the SAP security disclosure?
The security issues impacted several of SAP’s primary cloud offerings. Affected products included:
- SAP Cloud Platform
- SAP Analytics Cloud
- SAP SuccessFactors
- SAP Concur
- SAP/CallidusCloud Commissions
- SAP/Callidus Cloud CPQ
- SAP C4C/Sales Cloud
How did SAP respond to the security gaps?
SAP initiated a multi-faceted response to address the identified lapses. First, the company began individually notifying the approximately 40,000 affected customers to provide support. Second, SAP prioritized technical remediation efforts to patch the infrastructure of the impacted products. Finally, the company updated its security-related terms and conditions to better reflect its security standards while maintaining alignment with broader market practices.
Is there a link between this announcement and the Cloud Hopper hacking campaign?
No. SAP explicitly denied any connection between its internal security review findings and the Cloud Hopper hacking campaign. The Cloud Hopper campaign was a separate, state-sponsored cyber espionage operation that exfiltrated sensitive data by penetrating HPE’s cloud computing service, which is distinct from the internal security issues SAP disclosed in May 2020.