In a significant security incident, Google has issued a warning regarding a breach affecting the Salesloft Drift platform, which has compromised OAuth tokens used for Salesforce integrations and potentially all connected applications. The breach, attributed to a threat actor known as UNC6395, began on August 8, 2025, and involved extensive data theft from Salesforce customer instances. Google stated, 'we advise all Salesloft Drift customers to treat any and all authentication tokens as potentially compromised.' The attackers exploited stolen OAuth tokens, executing large-scale SOQL queries to extract sensitive information, including AWS access keys and passwords.
Salesloft clarified that the incident specifically impacted customers using the Drift integration with Salesforce, and they have since revoked all active access tokens associated with the application as a precautionary measure. The breach highlights a broader vulnerability associated with SaaS integrations, as noted by experts who emphasize the risks posed by OAuth token compromises. 'It is a known blind spot in most enterprise security programs,' remarked Cory Michal, Chief Security Officer at AppOmni.
The Google Threat Intelligence Group (GTIG) reported that the attackers demonstrated advanced operational security by deleting query jobs to avoid detection, while Salesforce event logs remained intact, allowing organizations to trace the activity. The breach has raised alarms about the security of SaaS applications, with hundreds of Salesforce customer organizations potentially affected. Google has urged affected organizations to conduct thorough investigations of their systems and to rotate credentials as a safeguard.
In response to this incident, Salesloft has engaged a third-party digital forensics team to investigate the breach further and to assist customers in understanding the impact. Organizations that have integrated Salesloft Drift with Salesforce are advised to assess their Salesforce objects for any sensitive data that may have been exposed. The ongoing investigation continues to reveal the extent of the compromise and the measures necessary to mitigate risks moving forward.
