Cloudflare
Disclosed Sep 2, 20251 year agoConfirmed
Cloudflare Salesforce data stolen via Salesloft Drift OAuth tokens
Cloudflare said an attacker used stolen Drift tokens to access its Salesforce support case system between August 12 and 17, 2025, taking customer contact data and support case contents that included 104 Cloudflare API tokens, which it rotated.
What is known
| People affected | Not stated in the sources we have |
|---|---|
| Disclosed | Sep 2, 2025 |
| Discovered | Aug 23, 2025 |
| Attack | Supply chain |
| Data exposed | Names, Emails, Phone numbers, API keys, Credentials and tokens, Other |
| Sector | Tech · US |
| Status | Confirmed |
| Part of | Salesloft drift (2025) |
Sources
| Source | |
|---|---|
| Cloudflare statement on the Salesloft Drift incidentblog.cloudflare.com · The organization | The organization |
| Cloudflare hit by data breach in Salesloft Drift supply chain attackbleepingcomputer.com · News | News |
| Salesloft Drift Breach: Track the Salesforce Incident (Nudge Security)driftbreach.com · News | News |
Notices filed
| Where | Filed | People |
|---|---|---|
| Researchtotal | Sep 2, 2025 |
Same campaign
Other breaches at Cloudflare
| Breach | Affected | ||||
|---|---|---|---|---|---|
| Nation-state actor uses Okta-stolen tokens to breach Cloudflare Atlassian systemsFeb 1, 20242 years agoHacking | Feb 1, 20242 years ago | Hacking | Tech | Confirmed | Unknown |
History of this record
- 2026-09-25 · added · seed source
First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.