Skip to content
Breaches.

Pantheon

Disclosed Sep 5, 20251 year agoConfirmed

Official notice

Pantheon Salesforce data stolen via Salesloft Drift OAuth tokens

Pantheon said attackers accessed its Salesforce CRM through the Drift integration between August 12 and 15, 2025, taking customer renewal information, internal sales account data and some contact details.

What is known

People affectedNot stated in the sources we have
DisclosedSep 5, 2025
DiscoveredAug 28, 2025
AttackSupply chain
Data exposedNames, Emails, Other
SectorTech · US
StatusConfirmed
Part ofSalesloft drift (2025)

Sources

Source
Pantheon statement on the Salesloft Drift incidentstatus.pantheon.io · The organization
Salesloft Drift Breach: Track the Salesforce Incident (Nudge Security)driftbreach.com · News

Notices filed

WhereFiledPeople
ResearchtotalSep 5, 2025

Same campaign

OrganizationAffected
Telus DigitalTelus Digital confirms breach after ShinyHunters claims 1 PB data theftMar 116 months agoSupply chainUnverifiedUnknown
GrubhubGrubhub confirms data theft using secrets stolen in Salesloft Drift attacksJan 158 months agoSupply chainUnverifiedUnknown
ToastToast Salesforce data stolen via Salesloft Drift OAuth tokensSep 18, 20251 year agoSupply chainUnknown
AvalaraAvalara Salesforce data stolen via Salesloft Drift OAuth tokensSep 12, 20251 year agoSupply chainUnknown
DynatraceDynatrace Salesforce data stolen via Salesloft Drift OAuth tokensSep 8, 20251 year agoSupply chainUnknown
FastlyFastly Salesforce data stolen via Salesloft Drift OAuth tokensSep 5, 20251 year agoSupply chainUnknown
TenableTenable Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
RubrikRubrik Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
QualysQualys Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
PagerDutyPagerDuty Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
JFrogJFrog Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
ElasticElastic Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
CyberArkCyberArk Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
Cato NetworksCato Networks Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
BeyondTrustBeyondTrust Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
NutanixNutanix Salesforce data stolen via Salesloft Drift OAuth tokensSep 3, 20251 year agoSupply chainUnknown
ProofpointProofpoint Salesforce data stolen via Salesloft Drift OAuth tokensSep 2, 20251 year agoSupply chainUnknown
Palo Alto NetworksPalo Alto Networks Salesforce data stolen via Salesloft Drift OAuth tokensSep 2, 20251 year agoSupply chainUnknown
CloudflareCloudflare Salesforce data stolen via Salesloft Drift OAuth tokensSep 2, 20251 year agoSupply chainUnknown
SpyCloudSpyCloud Salesforce data stolen via Salesloft Drift OAuth tokensSep 1, 20251 year agoSupply chainUnknown
EskerEsker Salesforce data stolen via Salesloft Drift OAuth tokensSep 1, 20251 year agoSupply chainUnknown
ZscalerZscaler Salesforce data stolen via Salesloft Drift OAuth tokensAug 30, 20251 year agoSupply chainUnknown
BugcrowdBugcrowd Salesforce data stolen via Salesloft Drift OAuth tokensAug 27, 20251 year agoSupply chainUnknown
SalesloftStolen Drift AI chatbot OAuth tokens used to raid customer Salesforce instancesAug 26, 20251 year agoSupply chainUnverifiedUnknown
History of this record
  • 2026-09-25 · added · seed source

First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.

Everything about Pantheon

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.