Skip to content
Overview
Between August 8 and 18, a stealthy adversary, tracked by Google as UNC6395 is suspected to have, quietly harvested OAuth and refresh tokens via the Salesloft Drift AI chat integration with Salesforce. At first glance, the breach appeared limited.
Salesloft initially reassured that only Salesforce linked users were affected. Yet as the investigation deepened, the threat surface expanded.
Google has confirmed cases impacting other integrations other than SalesForce CRM instances with Drift Mail impacting a limited number of Google Workspace accounts including Elastic being impacted.
At the time of writing, twenty-six (26) organisations have reported being affected by the incident. This number is expected to rise, with hundreds of companies potentially at risk.
Salesforce the most widely reported on integration disabled all integrations with Salesloft as a precaution which have since been restored. Salesloft state “While the connection between systems was disabled, both Salesloft and Salesforce continued to run independently. The Salesloft Customer Success team will be reaching out to you directly to help you with data reconciliation before we can re-enable your Salesforce sync.”
Multi-tier supply-chain risk
Multiple organisations that use Salesloft Drift integrations have been investigating their own impact, this has resulted in Exclaimer, Palo Alto, Cloudflare, Zscaler and many other customers reporting their own investigations.
Each has advised their customers of potential risk to customer data which usually involves email addresses, contact information and support information held in the Chatbot communications and within Salesforce CRM which have been obtained. The investigations do vary depending on the reported data leaked for each organisation. It does appear that the data is limited to communications within the Chatbot only, but this may not be the case, so keep your eyes peeled for new updates from vendors impacted by the incident.
Risks by supply-chain vendor
The risks below are subject to change as each vendor progresses their investigation. The vendors listed below are known to be impacted by Salesloft Drift.
| Vendor | Compromise | Impacted Data | Action | Ref |
|---|---|---|---|---|
| Exclaimer | Salesloft integration with Salesforce | Email addresses via Salesloft Drift communication. | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | Direct to customer |
| Palo Alto Networks | Salesloft integration with Salesforce | Business contact information, internal sales account and basic case data related to our customers. | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://www.paloaltonetworks.com/blog/2025/09/salesforce-third-party-application-incident-response/ |
| Tenable | Salesloft integration with Salesforce | A portion of some of our customers’ information stored in our Salesforce instance, including subject lines and initial descriptions provided by our customers when opening a tenable support case, and commonly available business contact information (such as names, business email addresses, phone numbers, and regional/location references). | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://www.tenable.com/blog/tenable-response-to-salesforce-and-salesloft-drift-incident |
| Zscaler | Salesloft integration with Salesforce | Names, business email addresses, job titles, phone numbers, regional/location details. Zscaler product licensing and commercial information, | Heightened awareness of phishing attacks and social engineering attacks using information gathered. License reuse. Information gathered from support chats may impact Zscaler customers potential lateral movement risk if sensitive data has been shared via support communications. | https://www.zscaler.com/blogs/company-news/salesloft-drift-supply-chain-incident-key-details-and-zscaler-s-response |
| PagerDuty | Salesloft integration with Salesforce | Names, phone numbers, and email addresses. | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://www.pagerduty.com/blog/news-announcements/salesloft-drift-data-breach-update-to-our-customers/ |
| Cloudflare | Salesloft integration with Salesforce | Support cases. The subject line of the Salesforce case. The body of the case (freeform text which may include any correspondence including keys, secrets, etc., if provided by the customer to Cloudflare). Customer contact information (for example, company name, requestor email address and phone number, company domain name, and company country) | Reset of credentials potentially shared to Cloudflare via support cases. Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://blog.cloudflare.com/response-to-salesloft-drift-incident/ |
| SpyCloud | Salesloft integration with Salesforce | Unknown | Heightened awareness of phishing attacks and social engineering attacks using information gathered. Be cautious of unusual communications related to your relationship with SpyCloud – for example, emails requesting or specifying payment terms. | https://spycloud.com/newsroom/salesloft-drift-incident-spycloud-response/ |
| Tanium | Salesloft integration with Salesforce | Names, business email addresses, phone numbers, regional/location references | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://www.tanium.com/blog/salesloft-drift-data-breach-what-we-know-and-what-were-doing/ |
| Proofpoint | Salesloft integration with Salesforce | Unknown – TA accessed Proofpoint’s Salesforce tenant through the compromised Drift integration and viewed certain information stored in our Salesforce instance. | TBD | https://www.proofpoint.com/us/blog/corporate-news/salesloft-drift-supply-chain-incident-response |
| Rubrik | Salesloft integration with Salesforce | TBD | TBD | https://www.rubrik.com/blog/company/25/salesforce-connected-third-party-drift-application-supply-chain-incident-response |
| BeyondTrust | Salesloft integration with Salesforce | Based on our investigation, the threat actors had limited access to our Salesforce data and the impact was limited to Salesforce. | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://www.beyondtrust.com/trust-center/security-advisories/salesforce-salesloft-drift-security-incident |
| Megaport | Salesloft integration with Salesforce | TBD – Limited to names and titles, business email addresses and business phone numbers | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://trust.megaport.com/?tcuUid=f3ee3f57-2b3c-4b77-96b2-aad93acd0c47 |
| Heap | Salesloft integration with Salesforce | TBD – Confirmed that a subset of records within Heap’s Salesforce instance was accessed by the threat actor. | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://trust.contentsquare.com/?tcuUid=2c81adf8-1e70-4130-9d1d-94966df59058 |
| Bugcrowd | Salesloft integration with Salesforce | TBD – Identified evidence that certain information stored within our Salesforce instance was accessed by an unauthorised user. | TBD | https://www.bugcrowd.com/blog/bugcrowd-response-to-salesforce-linked-third-party-drift-application-security-event/ |
| JFrog | Salesloft integration with Salesforce | TBD – “investigation is ongoing, we have discovered that some data stored in JFrog’s Salesforce instance was accessed by leveraging illegitimate access to the Drift Application.” | Following security best practices, we recommend revocation and rotation of credentials/keys/secrets and monitoring your environment for any unusual activity. | https://jfrog.com/help/r/salesforce-data-incident-identified-linked-to-third-party-salesloft-drift/salesforce-data-incident-identified-linked-to-third-party-salesloft-drift |
| Workiva | Salesloft integration with Salesforce | Within Salesforce – names, email addresses, phone numbers, and support ticket content. | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://www.bleepingcomputer.com/news/security/saas-giant-workiva-discloses-data-breach-after-salesforce-attack/ |
| Akamai | Salesloft integration with Salesforce | Limited service support tickets Akamai corporate email addresses and phone numbers. Customer corporate email addresses and phone numbers. Pseudonymised email addresses. A services-related support case description which included one outdated and inactive API token, and one active API token. | Heightened awareness of phishing attacks and social engineering attacks using information gathered. Rotate API tokens. | Direct to customer |
| Cyberark | Salesloft integration with Salesforce | The data accessed by the threat actor was limited to that contained in our Salesforce CRM, and may include business contact information, account and conversation metadata, and summary fields. | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://www.cyberark.com/resources/blog/salesloft-drift-incident-overview-and-cyberarks-response |
| Unknown | Salesloft integration with Drift Email – Google Workspace | Small number of Google Workspace accounts. | Google recommend s organisations take immediate action to review all third-party integrations connected to their Drift instance, revoke and rotate credentials for those applications, and investigate all connected systems for signs of unauthorised access. | https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift |
| Cato | Salesloft integration with Salesforce | The exposed Salesforce data included: customer business contact information, company attributes, and basic customer case information. | Review inbound communications carefully. Validate senders independently. Protect login credentials. | https://www.catonetworks.com/blog/cato-networks-statement-on-salesforce-salesloft-drift-incident/ |
| Esker | Salesloft integration with Salesforce | Potential data: names, business email addresses, job titles, phone numbers, plain text content from support tickets. | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://www.esker.com/blog/esker-news-and-culture/salesloft-and-drift-oauth-incident-affecting-salesforce-data-what/ |
| Black Duck | Salesloft integration with Salesforce | Exfiltrated data includes: names, business email addresses, job titles, phone numbers, regional/location details, service arrangement data, plain text content from support cases. | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://community.blackduck.com/s/article/Salesloft-Drift-Breach-Impact-on-Black-Duck-Update-to-Our-Customers |
| Nutanix | Salesloft integration with Salesforce | The impacted data was limited to customer support case records within our Salesforce environment that contained certain fields that primarily included business contacts and/or information relating to the case such as the subject field of the support case, the description field of the support case, and in limited instances, support case correspondence. | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://www.nutanix.com/blog/third-party-salesloft-drift-application-incident-response-our-impact-and-action |
| Qualys | Salesloft integration with Salesforce | Vague – limited access to Salesforce information | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://blog.qualys.com/misc/2025/09/06/salesloft-drift-supply-chain-incident |
| Dynatrace | Salesloft integration with Salesforce | Salesforce no case information. Limited to business contact information, including first and last names of customer contacts and company identifiers. | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://www.dynatrace.com/news/blog/salesloft-drift-incident-dynatraces-response/ |
| Fastly | Salesloft integration with Salesforce | Was isolated to our Salesforce instance and the data accessed was limited to case subjects, descriptions, and contact details. | Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://www.fastlystatus.com/incident/377884 |
| Elastic | Salesloft integration with Drift Email – Google Workspace | After scanning the contents of this inbox, we identified a small number of inbound emails that included potentially valid credentials. For each of these cases where we identified a potential credential leak, we notified customers through existing support channels. If you did not receive notice from us, we did not identify you as an affected customer. | Rotate credentials where affected. Heightened awareness of phishing attacks and social engineering attacks using information gathered. | https://www.elastic.co/blog/elastic-update-salesloft-drift-security-incident |
Map of supply chain
Recommendations for customers not directly impacted but are impacted by a third party:
- Continue to monitor for new incident response updates from your vendors.
- Increase phishing awareness for employees impacted.
- Investigate if your support case or communication data may contain sensitive data. In some cases, you may have shared credentials, API keys, configuration details, or other sensitive data within chats.
- Contact your vendors if you’re unsure if they’re impacted.
Recommendations for those directly impacted by Salesloft Drift integration:
- Revoke and rotate all OAuth tokens associated with Drift and credentials.
- Investigate audit logs within Salesforce and any applications related to Salesloft Drift.
- Enforce least privilege
- If directly impacted assess the data accessed. Review all customer support case data with your third-party providers to identify what sensitive information may have been exposed. Look for cases containing credentials, API keys, configuration details, or other sensitive data that customers may have shared.
Zensec – here to help
If your team is uncertain about the implications of the Salesloft Drift breach or unsure of the next steps, don’t navigate this complex situation alone. Zensec’s experts are ready to assist you in understanding the impact and implementing effective solutions.
Contact us today to ensure your organisation is secure and informed.
