INCIDENT REPORT · CP-2025-013

Salesloft Drift OAuth token theft and Salesforce data-theft campaign

L3 · ELEVATEDCONFIRMED

Between at least 8 and 18 August 2025, a threat actor used tokens stolen from the Salesloft Drift chatbot integration to exfiltrate data, including secrets, from hundreds of companies' Salesforce environments.

Incident ID: CP-2025-013
Incident date: 08 AUG 2025
Detection date: Not publicly documented
Affected countries: United States
Plotted location: Atlanta, Georgia, United States (Headquarters of compromised integration provider (Salesloft); victims were global)
Threat classification: Level 3 — ELEVATED
Classification rationale: SaaS supply-chain compromise affecting hundreds of major organizations across sectors.
Attack type: Supply-Chain Attack
Nature: Malicious activity
Attack vector: Stolen OAuth/refresh tokens for the Salesloft Drift integration used to run bulk queries against customers' Salesforce instances
Sectors: Technology
Critical infrastructure: No
Organizations affected: Salesloft, Cloudflare, Zscaler, Palo Alto Networks, Google Workspace (limited accounts)
Operational consequences: Google said more than 700 organizations may have been affected; Cloudflare, Zscaler and Palo Alto Networks among others confirmed exposure of Salesforce data and rotated exposed credentials. Salesloft and Salesforce revoked all Drift tokens.
Estimated financial impact: No reliably documented figure
Attribution (as stated): Tracked by Google Threat Intelligence Group as UNC6395; no official state attribution

SOURCE REFERENCES

RECORD CREATED 14 NOV 2026 · LAST UPDATED 14 NOV 2026 · Threat levels are editorial assessments, not official government ratings.

Salesloft Drift OAuth token theft and Salesforce data-theft campaign

L3 · ELEVATEDCONFIRMED

Incident ID

CP-2025-013

Incident date

08 AUG 2025

Detection date

Not publicly documented

Affected countries

United States

Plotted location

Atlanta, Georgia, United States (Headquarters of compromised integration provider (Salesloft); victims were global)

Threat classification

Level 3 — ELEVATED

Classification rationale

SaaS supply-chain compromise affecting hundreds of major organizations across sectors.

Attack type

Supply-Chain Attack

Nature

Malicious activity

Attack vector

Stolen OAuth/refresh tokens for the Salesloft Drift integration used to run bulk queries against customers' Salesforce instances

Sectors

Technology

Critical infrastructure

Organizations affected

Salesloft, Cloudflare, Zscaler, Palo Alto Networks, Google Workspace (limited accounts)

Operational consequences

Google said more than 700 organizations may have been affected; Cloudflare, Zscaler and Palo Alto Networks among others confirmed exposure of Salesforce data and rotated exposed credentials. Salesloft and Salesforce revoked all Drift tokens.

Estimated financial impact

No reliably documented figure

Attribution (as stated)

Tracked by Google Threat Intelligence Group as UNC6395; no official state attribution