Salesloft Drift Breach: A Supply Chain Attack Exposing Vulnerabilities

In a significant cybersecurity breach, Salesloft has confirmed that the compromise of its GitHub account between March and June 2025 led to a widespread data theft involving its Drift application. The attack, attributed to the threat group UNC6395, allowed hackers to access sensitive OAuth tokens, which were subsequently used to infiltrate Salesforce instances of numerous organizations, including major tech firms like Google, Cloudflare, and Palo Alto Networks.

Salesloft GitHub Breach Led to Salesforce Data Theft AttacksSalesloft Breach: GitHub Hack Steals OAuth Tokens, Hits Cloudflare ClientsSalesloft Breach – Mandiant Investigation Exposes 6-Month Cyber CampaignSalesloft GitHub Account Compromised Months Before Salesforce AttackThe Register UKSalesloft Drift Hack Claims New Victims in Tenable, QualysNew Round of Stolen OAuth Tokens Obtained From Salesloft Drift Platform Led to Compromise of Cloudflare, Palo Alto Networks & ZscalerTechCrunchSalesloft Drift data breach: Investigation reveals how attackers got in

• March - June 2025: Attackers accessed Salesloft's GitHub account, downloading content from multiple repositories and establishing unauthorized workflows.

Salesloft GitHub Account Compromised Months Before Salesforce Attack

• August 8 - 18, 2025: The main data theft campaign occurred, utilizing stolen OAuth tokens to access Salesforce data across various organizations.

Salesloft GitHub Breach Led to Salesforce Data Theft Attacks

• September 5, 2025: Salesloft took the Drift application offline as a precautionary measure, while Salesforce temporarily suspended its integration with Drift.

GitHub Account Compromise Led to Salesloft Drift Breach Affecting 22 Companies

The investigation led by Google-owned Mandiant revealed that the attackers conducted reconnaissance activities within the Salesloft and Drift environments before launching the data theft. They accessed Drift's Amazon Web Services (AWS) environment, where they obtained OAuth tokens that allowed them to breach customer Salesforce instances. The compromised data primarily included business contact information and sensitive credentials, such as AWS access keys and passwords.

Salesloft Breach – Mandiant Investigation Exposes 6-Month Cyber CampaignSalesloft Drift Breach Traced to GitHub Compromise and Stolen OAuth TokensSalesloft GitHub Breach Led to Salesforce Data Theft AttacksNew Round of Stolen OAuth Tokens Obtained From Salesloft Drift Platform Led to Compromise of Cloudflare, Palo Alto Networks & ZscalerSalesloft Breach: GitHub Hack Steals OAuth Tokens, Hits Cloudflare ClientsSalesloft Drift data breach: Investigation reveals how attackers got inSalesloft GitHub Account Compromised Months Before Salesforce AttackSalesloft: Hacker broke into systems in March through GitHub accountSalesloft Drift Hack Claims New Victims in Tenable, QualysCyberscoop

Salesloft's breach has affected at least 22 companies, with many reporting unauthorized access to customer data stored in their Salesforce instances. Notable victims include:

Salesloft Drift Incident Expands: Tenable Confirms Customer Data Breach

• Cloudflare

The Register UK

• Zscaler

Salesloft Drift Hack Claims New Victims in Tenable, Qualys

• Palo Alto Networks

Salesloft Breach: GitHub Hack Steals OAuth Tokens, Hits Cloudflare Clients

• Tenable

Salesloft Drift Incident Expands: Tenable Confirms Customer Data Breach

• Bugcrowd

TechCrunch

• Proofpoint

New Round of Stolen OAuth Tokens Obtained From Salesloft Drift Platform Led to Compromise of Cloudflare, Palo Alto Networks & Zscaler

These organizations have since taken steps to mitigate the risks, including revoking compromised credentials and disabling the Drift application.

Salesloft Breach: GitHub Hack Steals OAuth Tokens, Hits Cloudflare Clients

Salesloft stated that the incident has been contained and emphasized the importance of rotating all affected credentials. The company has isolated Drift's infrastructure and is working to enhance security measures. Salesforce has restored its integration with Salesloft but has kept the Drift application disabled pending further investigation.

GitHub Account Compromise Led to Salesloft Drift Breach Affecting 22 CompaniesCybersecurityDiveThe Register UKSalesloft Drift data breach: Investigation reveals how attackers got inSalesloft Drift Breach Traced to GitHub Compromise and Stolen OAuth TokensSalesloft GitHub Account Compromised Months Before Salesforce AttackSalesloft: Hacker broke into systems in March through GitHub accountQualys, Tenable Latest Victims of Salesloft Drift HackNew Round of Stolen OAuth Tokens Obtained From Salesloft Drift Platform Led to Compromise of Cloudflare, Palo Alto Networks & ZscalerCyberscoop

Security analysts have raised concerns about Salesloft's security posture, particularly regarding the six-month delay in detecting the initial GitHub breach. Experts have called for improved monitoring and stricter access controls for third-party applications, highlighting the need for organizations to protect non-human identities, such as API tokens.

Salesloft Breach – Mandiant Investigation Exposes 6-Month Cyber Campaign

While Salesloft has confirmed the breach's containment, there are discrepancies regarding the total number of affected organizations and the extent of the data stolen. Estimates suggest that around 700 companies may have been impacted, but the exact scope remains unclear.

Salesloft: Hacker broke into systems in March through GitHub account

As investigations continue, regulatory scrutiny is expected to increase, potentially leading to new guidelines for SaaS security. Organizations are urged to conduct regular audits of their code repositories and implement zero-trust architectures to mitigate future risks.

Salesloft Breach: GitHub Hack Steals OAuth Tokens, Hits Cloudflare Clients

• “The threat actor used the stolen OAuth tokens to access data via Drift integrations.” — Salesloft

Cyberscoop

• “This incident highlights a significant systemic blind spot in how organizations manage ‘Non-Human Identities’ like API tokens, which are used for communication between platforms,” — Rom Carmel, CEO of Apono

Salesloft: Hacker broke into systems in March through GitHub account

• “Security experts warn that the incident underscores growing risks in cloud-first environments where third-party integrations can become powerful attack vectors, urging organisations to immediately audit OAuth permissions and implement stricter access controls for third-party applications.” — Cybersecurity Analyst

Salesloft Breach – Mandiant Investigation Exposes 6-Month Cyber Campaign

This incident serves as a critical reminder of the vulnerabilities inherent in interconnected software ecosystems and the need for robust security measures to protect sensitive data.

Salesloft Breach: GitHub Hack Steals OAuth Tokens, Hits Cloudflare Clients