Skip to content

Proofpoint

Disclosed Sep 2, 20251 year agoConfirmed

Official notice

Proofpoint Salesforce data stolen via Salesloft Drift OAuth tokens

Proofpoint said Salesforce notified it of suspicious Drift-related access to its Salesforce environment, and that there was no evidence its products, customer-protected data or corporate network were affected.

What is known

People affectedNot stated in the sources we have
DisclosedSep 2, 2025
AttackSupply chain
Data exposedNames, Emails, Other
SectorTech · US
StatusConfirmed
Part ofSalesloft drift (2025)

Sources

Source
Proofpoint statement on the Salesloft Drift incidentproofpoint.com · The organization
Salesloft Drift Breach: Track the Salesforce Incident (Nudge Security)driftbreach.com · News

Notices filed

WhereFiledPeople
ResearchtotalSep 2, 2025

Same campaign

OrganizationAffected
Telus DigitalTelus Digital confirms breach after ShinyHunters claims 1 PB data theftMar 116 months agoSupply chainUnverifiedUnknown
GrubhubGrubhub confirms data theft using secrets stolen in Salesloft Drift attacksJan 158 months agoSupply chainUnverifiedUnknown
ToastToast Salesforce data stolen via Salesloft Drift OAuth tokensSep 18, 20251 year agoSupply chainUnknown
AvalaraAvalara Salesforce data stolen via Salesloft Drift OAuth tokensSep 12, 20251 year agoSupply chainUnknown
DynatraceDynatrace Salesforce data stolen via Salesloft Drift OAuth tokensSep 8, 20251 year agoSupply chainUnknown
PantheonPantheon Salesforce data stolen via Salesloft Drift OAuth tokensSep 5, 20251 year agoSupply chainUnknown
FastlyFastly Salesforce data stolen via Salesloft Drift OAuth tokensSep 5, 20251 year agoSupply chainUnknown
TenableTenable Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
RubrikRubrik Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
QualysQualys Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
PagerDutyPagerDuty Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
JFrogJFrog Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
ElasticElastic Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
CyberArkCyberArk Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
Cato NetworksCato Networks Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
BeyondTrustBeyondTrust Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
NutanixNutanix Salesforce data stolen via Salesloft Drift OAuth tokensSep 3, 20251 year agoSupply chainUnknown
Palo Alto NetworksPalo Alto Networks Salesforce data stolen via Salesloft Drift OAuth tokensSep 2, 20251 year agoSupply chainUnknown
CloudflareCloudflare Salesforce data stolen via Salesloft Drift OAuth tokensSep 2, 20251 year agoSupply chainUnknown
SpyCloudSpyCloud Salesforce data stolen via Salesloft Drift OAuth tokensSep 1, 20251 year agoSupply chainUnknown
EskerEsker Salesforce data stolen via Salesloft Drift OAuth tokensSep 1, 20251 year agoSupply chainUnknown
ZscalerZscaler Salesforce data stolen via Salesloft Drift OAuth tokensAug 30, 20251 year agoSupply chainUnknown
BugcrowdBugcrowd Salesforce data stolen via Salesloft Drift OAuth tokensAug 27, 20251 year agoSupply chainUnknown
SalesloftStolen Drift AI chatbot OAuth tokens used to raid customer Salesforce instancesAug 26, 20251 year agoSupply chainUnverifiedUnknown
History of this record
  • 2026-09-25 · added · seed source

First seen 2026-09-25 (Research), confirmed by Research. Record counts are as reported. Not legal advice.

Everything about Proofpoint

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.