Story perspectives

Google Responds to Salesforce Attacks Amid Data Theft Campaign

8/30/2025

45 10

Summary

Story summary

Google reported extensive attacks on Salesforce through Salesloft Drift, impacting all integrations.
Attackers accessed Google Workspace accounts using stolen OAuth tokens on August 9, 2025.
Google revoked compromised tokens and disabled the Drift integration, advising organizations to assess third-party connections.
Salesloft suspended all Salesforce integrations, claiming no detected malicious activity.
The incident is connected to UNC6395's data theft campaign from August 8 to 18, 2025.

1 of 1

Story summary

Google reported extensive attacks on Salesforce through Salesloft Drift, impacting all integrations.
Attackers accessed Google Workspace accounts using stolen OAuth tokens on August 9, 2025.
Google revoked compromised tokens and disabled the Drift integration, advising organizations to assess third-party connections.
Salesloft suspended all Salesforce integrations, claiming no detected malicious activity.
The incident is connected to UNC6395's data theft campaign from August 8 to 18, 2025.