Story perspectives

Salesloft Data Breach: Hackers Compromise OAuth Tokens

9/2/2025

49 9

Summary

Story summary

A data breach involving Salesloft's Drift AI chatbot has compromised OAuth tokens, impacting Google Workspace and Salesforce integrations.
Hackers known as UNC6395 accessed sensitive data from platforms like AWS and Microsoft Azure using these tokens.
Companies are advised to invalidate affected tokens and enhance security measures.
This incident is part of a larger social engineering campaign affecting major corporations.
Salesloft has hired Mandiant to investigate the breach's causes.

1 of 1

Story summary

A data breach involving Salesloft's Drift AI chatbot has compromised OAuth tokens, impacting Google Workspace and Salesforce integrations.
Hackers known as UNC6395 accessed sensitive data from platforms like AWS and Microsoft Azure using these tokens.
Companies are advised to invalidate affected tokens and enhance security measures.
This incident is part of a larger social engineering campaign affecting major corporations.
Salesloft has hired Mandiant to investigate the breach's causes.