Skip to content
Breaches.

BeyondTrust

Disclosed Sep 4, 20251 year agoUnverified

BeyondTrust Salesforce data stolen via Salesloft Drift OAuth tokens

BeyondTrust said Salesforce notified it on August 22, 2025 of suspicious activity in which attackers used Drift-linked credentials to access its Salesforce instance.

What is known

People affectedNot stated in the sources we have
DisclosedSep 4, 2025
DiscoveredAug 22, 2025
AttackSupply chain
Data exposedNames, Emails, Other
SectorTech · US
StatusUnverified: not yet confirmed by an official notice, a filing or the organization
Part ofSalesloft drift (2025)

Sources

Source
SaaS giant Workiva discloses data breach after Salesforce attackbleepingcomputer.com · News
Salesloft Drift Breach: Track the Salesforce Incident (Nudge Security)driftbreach.com · News

Notices filed

WhereFiledPeople
ResearchtotalSep 4, 2025

Same campaign

OrganizationAffected
Telus DigitalTelus Digital confirms breach after ShinyHunters claims 1 PB data theftMar 116 months agoSupply chainUnverifiedUnknown
GrubhubGrubhub confirms data theft using secrets stolen in Salesloft Drift attacksJan 158 months agoSupply chainUnverifiedUnknown
ToastToast Salesforce data stolen via Salesloft Drift OAuth tokensSep 18, 20251 year agoSupply chainUnknown
AvalaraAvalara Salesforce data stolen via Salesloft Drift OAuth tokensSep 12, 20251 year agoSupply chainUnknown
DynatraceDynatrace Salesforce data stolen via Salesloft Drift OAuth tokensSep 8, 20251 year agoSupply chainUnknown
PantheonPantheon Salesforce data stolen via Salesloft Drift OAuth tokensSep 5, 20251 year agoSupply chainUnknown
FastlyFastly Salesforce data stolen via Salesloft Drift OAuth tokensSep 5, 20251 year agoSupply chainUnknown
TenableTenable Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
RubrikRubrik Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
QualysQualys Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
PagerDutyPagerDuty Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
JFrogJFrog Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
ElasticElastic Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
CyberArkCyberArk Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
Cato NetworksCato Networks Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
NutanixNutanix Salesforce data stolen via Salesloft Drift OAuth tokensSep 3, 20251 year agoSupply chainUnknown
ProofpointProofpoint Salesforce data stolen via Salesloft Drift OAuth tokensSep 2, 20251 year agoSupply chainUnknown
Palo Alto NetworksPalo Alto Networks Salesforce data stolen via Salesloft Drift OAuth tokensSep 2, 20251 year agoSupply chainUnknown
CloudflareCloudflare Salesforce data stolen via Salesloft Drift OAuth tokensSep 2, 20251 year agoSupply chainUnknown
SpyCloudSpyCloud Salesforce data stolen via Salesloft Drift OAuth tokensSep 1, 20251 year agoSupply chainUnknown
EskerEsker Salesforce data stolen via Salesloft Drift OAuth tokensSep 1, 20251 year agoSupply chainUnknown
ZscalerZscaler Salesforce data stolen via Salesloft Drift OAuth tokensAug 30, 20251 year agoSupply chainUnknown
BugcrowdBugcrowd Salesforce data stolen via Salesloft Drift OAuth tokensAug 27, 20251 year agoSupply chainUnknown
SalesloftStolen Drift AI chatbot OAuth tokens used to raid customer Salesforce instancesAug 26, 20251 year agoSupply chainUnverifiedUnknown
History of this record
  • 2026-09-25 · added · seed source

First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.

Everything about BeyondTrust

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.