Nobody hacked Salesforce. Attackers simply used the access that hundreds of companies had already granted to an AI chat assistant, and exported their data with it.
What happened
Between 8 and 18 August 2025, a threat actor tracked by Google as UNC6395 used stolen OAuth tokens belonging to the Drift AI chat integration from Salesloft to pull data out of customers' Salesforce instances. Google said it was aware of over 700 potentially impacted organisations. Confirmed victims included Cloudflare, Zscaler, Palo Alto Networks, Proofpoint and Tenable.
On 20 August, Salesloft and Salesforce revoked all Drift tokens and Salesforce removed Drift from its AppExchange. Google later reported that the impact was "not exclusive to the Salesforce integration": stolen tokens were also used to read email in a very small number of Google Workspace accounts connected to Drift.
How the attack worked
The root cause sat months earlier. Between March and June 2025, the attacker accessed Salesloft's GitHub account, according to the investigation by Mandiant. From there it reached Drift's cloud environment and took the OAuth tokens that customers' integrations used.
With those tokens, the attacker did not need passwords or MFA. It bulk-exported records such as support cases, accounts, users and opportunities, then searched the stolen data for secrets: AWS access keys, passwords and Snowflake tokens. It deleted its query jobs to cover its tracks, although logs survived. Cloudflare, for example, found 104 API tokens in its exported support cases and rotated all of them.
Why it matters for your organisation
Organisations are connecting AI assistants, chatbots and automation tools to email, CRM, file storage and finance systems at speed. Each connection is usually granted through OAuth with broad, long-lived permissions that nobody reviews again. If the vendor is compromised, so is the access.
The Drift case also shows where secrets hide. Support tickets, emails and CRM notes often contain passwords, keys and customer information pasted in for convenience. Attackers know this and search for it.
What to do now
- Inventory every connected app in Microsoft 365, Google Workspace and your CRM, including AI tools, and remove those you do not use.
- Reduce scopes. Give integrations read access only to what they need, and avoid tenant-wide permissions.
- Monitor for bulk exports and unusual API activity from integration accounts.
- Keep secrets out of tickets and notes. Search existing records for credentials and rotate anything you find.
- Plan to revoke fast. Know how to cut off a vendor's tokens within minutes when it reports a breach.
How Blacknote helps
Our AI & Agentic Security reviews map which AI tools and integrations can reach your company's and customers' data, cut excessive permissions and set up monitoring, so that a breach at a vendor does not become a breach at your organisation.
Sources
- Google Cloud Threat Intelligence: Widespread data theft targets Salesforce instances via Salesloft Drift
- Cloudflare: The impact of the Salesloft Drift breach on Cloudflare and our customers
- The Hacker News: Salesloft OAuth breach via Drift AI chat agent
- The Hacker News: GitHub account compromise led to Salesloft Drift breach
- The Record: Salesloft Drift breach hits Cloudflare, Zscaler, Palo Alto Networks