Skip to content
Breaches.

PagerDuty

Disclosed Sep 4, 20251 year agoConfirmed

Official notice

PagerDuty Salesforce data stolen via Salesloft Drift OAuth tokens

PagerDuty said it was informed on August 23, 2025 that a threat actor may have accessed its Salesforce instance through the compromised Drift authorization flow.

What is known

People affectedNot stated in the sources we have
DisclosedSep 4, 2025
DiscoveredAug 23, 2025
AttackSupply chain
Data exposedNames, Emails, Other
SectorTech · US
StatusConfirmed
Part ofSalesloft drift (2025)

Sources

Source
Salesloft Drift Breach: Track the Salesforce Incident (Nudge Security)driftbreach.com · News
PagerDuty statement on the Salesloft Drift incidentpagerduty.com · The organization

Notices filed

WhereFiledPeople
ResearchtotalSep 4, 2025

Same campaign

OrganizationAffected
Telus DigitalTelus Digital confirms breach after ShinyHunters claims 1 PB data theftMar 116 months agoSupply chainUnverifiedUnknown
GrubhubGrubhub confirms data theft using secrets stolen in Salesloft Drift attacksJan 158 months agoSupply chainUnverifiedUnknown
ToastToast Salesforce data stolen via Salesloft Drift OAuth tokensSep 18, 20251 year agoSupply chainUnknown
AvalaraAvalara Salesforce data stolen via Salesloft Drift OAuth tokensSep 12, 20251 year agoSupply chainUnknown
DynatraceDynatrace Salesforce data stolen via Salesloft Drift OAuth tokensSep 8, 20251 year agoSupply chainUnknown
PantheonPantheon Salesforce data stolen via Salesloft Drift OAuth tokensSep 5, 20251 year agoSupply chainUnknown
FastlyFastly Salesforce data stolen via Salesloft Drift OAuth tokensSep 5, 20251 year agoSupply chainUnknown
TenableTenable Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
RubrikRubrik Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
QualysQualys Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
JFrogJFrog Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
ElasticElastic Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
CyberArkCyberArk Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
Cato NetworksCato Networks Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
BeyondTrustBeyondTrust Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
NutanixNutanix Salesforce data stolen via Salesloft Drift OAuth tokensSep 3, 20251 year agoSupply chainUnknown
ProofpointProofpoint Salesforce data stolen via Salesloft Drift OAuth tokensSep 2, 20251 year agoSupply chainUnknown
Palo Alto NetworksPalo Alto Networks Salesforce data stolen via Salesloft Drift OAuth tokensSep 2, 20251 year agoSupply chainUnknown
CloudflareCloudflare Salesforce data stolen via Salesloft Drift OAuth tokensSep 2, 20251 year agoSupply chainUnknown
SpyCloudSpyCloud Salesforce data stolen via Salesloft Drift OAuth tokensSep 1, 20251 year agoSupply chainUnknown
EskerEsker Salesforce data stolen via Salesloft Drift OAuth tokensSep 1, 20251 year agoSupply chainUnknown
ZscalerZscaler Salesforce data stolen via Salesloft Drift OAuth tokensAug 30, 20251 year agoSupply chainUnknown
BugcrowdBugcrowd Salesforce data stolen via Salesloft Drift OAuth tokensAug 27, 20251 year agoSupply chainUnknown
SalesloftStolen Drift AI chatbot OAuth tokens used to raid customer Salesforce instancesAug 26, 20251 year agoSupply chainUnverifiedUnknown
History of this record
  • 2026-09-25 · added · seed source

First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.

Everything about PagerDuty

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.