Salesloft Drift supply chain breach exposes Salesforce data

A supply chain compromise of Salesloft’s Drift chat integration has allowed attackers to harvest authentication tokens and access Salesforce customer data from multiple major companies, investigators and affected firms said, in an incident that began with a GitHub breach earlier this year and culminated in exploited integrations in August. Companies including Cloudflare, Zscaler and Palo Alto Networks confirmed their Salesforce instances were accessed, and researchers warned the campaign may have exposed credentials and other sensitive materials across hundreds of organizations.

Salesloft said it engaged Mandiant on August 28 and that investigators found the intruder accessed a Salesloft GitHub account between March and June 2025, downloading repository content, adding a guest user and creating workflows. Reconnaissance activity was observed in Salesloft and Drift environments during that period, the company said, and attackers subsequently moved to Drift’s Amazon Web Services environment where they obtained OAuth tokens for Drift customers. Those tokens were used to access integrated Salesforce instances in a concentrated campaign in early to mid August, Google’s Threat...