Incident · Resolved
Salesloft Drift Breach
Salesloft Drift · 2 stories since AUG 29
- 2
- stories
- SEP 3
- latest
The story so far
In August 2025, a group Google calls UNC6395 stole OAuth tokens for the Salesloft Drift integration and used them to export data from many companies’ Salesforce instances, hunting through it for passwords and keys. Cloudflare was among the victims: it disclosed that the attackers had access to its Salesforce support cases from Aug. 12 to 17.
Written by the editors