Every public data breach

Disclosed this week44On record26,355

44 disclosed this week · 26,355 on record

Salesloft

Disclosed Aug 26, 2025Unverified

Stolen Drift AI chatbot OAuth tokens used to raid customer Salesforce instances

After breaching Salesloft's GitHub account in March 2025 and then Drift's AWS environment, attackers used stolen OAuth tokens for the Drift AI chat integration to export data from many customers' Salesforce instances in August 2025, hunting for credentials such as AWS keys and Snowflake tokens. Google later found Drift Email tokens were also abused to read some Google Workspace mail.

What is known

People affectedNot stated in the sources we have
DisclosedAug 26, 2025
AttackSupply chain
Data exposedAPI keysCredentials and tokensSource codeNamesEmailsInternal documents
SectorTech · US
StatusUnverified: not yet confirmed by an official notice, a filing or the organization
Part ofSalesloft drift (2025)

Sources

Newstechcrunch.com
Salesloft says Drift customer data thefts linked to March GitHub account hack
Newsbleepingcomputer.com
Salesloft breached to steal OAuth tokens for Salesforce data-theft attacks
Newsbleepingcomputer.com
Salesloft: March GitHub repo breach led to Salesforce data theft attacks
Newsdriftbreach.com
Salesloft Drift Breach: Track the Salesforce Incident (Nudge Security)
Newscloud.google.com
Widespread Data Theft Targets Salesforce Instances via Salesloft Drift

Notices filed

TotalAug 26, 2025
ResearchCount not stated
TotalAug 26, 2025
ResearchCount not stated

Same campaign

Telus DigitalSupply chain exposed messages, credentials and tokens, source code and financial details.Supply chainTechCAUnverifiedMar 11GrubhubSupply chain exposed names and emails.Supply chainRetailUSUnverifiedJan 15ToastSupply chain exposed names, emails and addresses.Supply chainTechUSSep 18, 2025AvalaraSupply chain exposed names, emails, phone numbers and financial details.Supply chainTechUSSep 12, 2025DynatraceSupply chain exposed names and emails.Supply chainTechUSSep 8, 2025PantheonSupply chain exposed names and emails.Supply chainTechUSSep 5, 2025FastlySupply chain exposed names and emails.Supply chainTechUSSep 5, 2025TenableSupply chain exposed names, emails and phone numbers.Supply chainTechUSSep 4, 2025RubrikSupply chain exposed names and emails.Supply chainTechUSUnverifiedSep 4, 2025QualysSupply chain exposed names and emails.Supply chainTechUSSep 4, 2025PagerDutySupply chain exposed names and emails.Supply chainTechUSSep 4, 2025JFrogSupply chain exposed names and emails.Supply chainTechUSUnverifiedSep 4, 2025ElasticSupply chain exposed emails and credentials and tokens.Supply chainTechUSSep 4, 2025CyberArkSupply chain exposed names and emails.Supply chainTechUSUnverifiedSep 4, 2025Cato NetworksSupply chain exposed names and emails.Supply chainTechILUnverifiedSep 4, 2025BeyondTrustSupply chain exposed names and emails.Supply chainTechUSUnverifiedSep 4, 2025NutanixSupply chain exposed names, emails and phone numbers.Supply chainTechUSSep 3, 2025ProofpointSupply chain exposed names and emails.Supply chainTechUSSep 2, 2025Palo Alto NetworksSupply chain exposed names, emails and phone numbers.Supply chainTechUSSep 2, 2025CloudflareSupply chain exposed names, emails, phone numbers, API keys and credentials and tokens.Supply chainTechUSSep 2, 2025SpyCloudSupply chain exposed names and emails.Supply chainTechUSSep 1, 2025EskerSupply chain exposed names, emails, phone numbers and employment records.Supply chainTechFRSep 1, 2025ZscalerSupply chain exposed names, emails and phone numbers.Supply chainTechUSAug 30, 2025BugcrowdSupply chain exposed names and emails.Supply chainTechUSAug 27, 2025
History of this record
data_types2026-09-25
["api-keys","credentials","source-code"] to ["api-keys","credentials","source-code","names","emails","internal-docs"]by seedSource
summary2026-09-25
Hackers stole OAuth and refresh tokens for Salesloft's Drift chat integration and used them between August 8 and 18, 2025 to export data from hundreds of customers' Salesforce instances, hunting for credentials such as AWS keys; Salesloft l to After breaching Salesloft's GitHub account in March 2025 and then Drift's AWS environment, attackers used stolen OAuth tokens for the Drift AI chat integration to export data from many customers' Salesforce instances in August 2025, huntingby seedSource
title2026-09-25
Salesloft Drift OAuth tokens stolen to raid customers' Salesforce data to Stolen Drift AI chatbot OAuth tokens used to raid customer Salesforce instancesby seedSource
Added2026-09-25
First recordedby seedSource

First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.

Everything about Salesloft