Skip to content
Breaches.

Salesloft

Disclosed Aug 26, 20251 year agoUnverified

Stolen Drift AI chatbot OAuth tokens used to raid customer Salesforce instances

After breaching Salesloft's GitHub account in March 2025 and then Drift's AWS environment, attackers used stolen OAuth tokens for the Drift AI chat integration to export data from many customers' Salesforce instances in August 2025, hunting for credentials such as AWS keys and Snowflake tokens. Google later found Drift Email tokens were also abused to read some Google Workspace mail.

What is known

People affectedNot stated in the sources we have
DisclosedAug 26, 2025
AttackSupply chain
Data exposedAPI keys, Credentials and tokens, Source code, Names, Emails, Internal documents
SectorTech · US
StatusUnverified: not yet confirmed by an official notice, a filing or the organization
Part ofSalesloft drift (2025)

Sources

Source
Salesloft says Drift customer data thefts linked to March GitHub account hacktechcrunch.com · News
Salesloft breached to steal OAuth tokens for Salesforce data-theft attacksbleepingcomputer.com · News
Salesloft: March GitHub repo breach led to Salesforce data theft attacksbleepingcomputer.com · News
Salesloft Drift Breach: Track the Salesforce Incident (Nudge Security)driftbreach.com · News
Widespread Data Theft Targets Salesforce Instances via Salesloft Driftcloud.google.com · News

Notices filed

WhereFiledPeople
ResearchtotalAug 26, 2025
ResearchtotalAug 26, 2025

Same campaign

OrganizationAffected
Telus DigitalTelus Digital confirms breach after ShinyHunters claims 1 PB data theftMar 116 months agoSupply chainUnverifiedUnknown
GrubhubGrubhub confirms data theft using secrets stolen in Salesloft Drift attacksJan 158 months agoSupply chainUnverifiedUnknown
ToastToast Salesforce data stolen via Salesloft Drift OAuth tokensSep 18, 20251 year agoSupply chainUnknown
AvalaraAvalara Salesforce data stolen via Salesloft Drift OAuth tokensSep 12, 20251 year agoSupply chainUnknown
DynatraceDynatrace Salesforce data stolen via Salesloft Drift OAuth tokensSep 8, 20251 year agoSupply chainUnknown
PantheonPantheon Salesforce data stolen via Salesloft Drift OAuth tokensSep 5, 20251 year agoSupply chainUnknown
FastlyFastly Salesforce data stolen via Salesloft Drift OAuth tokensSep 5, 20251 year agoSupply chainUnknown
TenableTenable Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
RubrikRubrik Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
QualysQualys Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
PagerDutyPagerDuty Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
JFrogJFrog Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
ElasticElastic Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnknown
CyberArkCyberArk Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
Cato NetworksCato Networks Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
BeyondTrustBeyondTrust Salesforce data stolen via Salesloft Drift OAuth tokensSep 4, 20251 year agoSupply chainUnverifiedUnknown
NutanixNutanix Salesforce data stolen via Salesloft Drift OAuth tokensSep 3, 20251 year agoSupply chainUnknown
ProofpointProofpoint Salesforce data stolen via Salesloft Drift OAuth tokensSep 2, 20251 year agoSupply chainUnknown
Palo Alto NetworksPalo Alto Networks Salesforce data stolen via Salesloft Drift OAuth tokensSep 2, 20251 year agoSupply chainUnknown
CloudflareCloudflare Salesforce data stolen via Salesloft Drift OAuth tokensSep 2, 20251 year agoSupply chainUnknown
SpyCloudSpyCloud Salesforce data stolen via Salesloft Drift OAuth tokensSep 1, 20251 year agoSupply chainUnknown
EskerEsker Salesforce data stolen via Salesloft Drift OAuth tokensSep 1, 20251 year agoSupply chainUnknown
ZscalerZscaler Salesforce data stolen via Salesloft Drift OAuth tokensAug 30, 20251 year agoSupply chainUnknown
BugcrowdBugcrowd Salesforce data stolen via Salesloft Drift OAuth tokensAug 27, 20251 year agoSupply chainUnknown
History of this record
  • 2026-09-25 · data_types: ["api-keys","credentials","source-code"] to ["api-keys","credentials","source-code","names","emails","internal-docs"] · seed source
  • 2026-09-25 · summary: Hackers stole OAuth and refresh tokens for Salesloft's Drift chat integration and used them between August 8 and 18, 2025 to export data from hundreds of customers' Salesforce instances, hunting for credentials such as AWS keys; Salesloft l to After breaching Salesloft's GitHub account in March 2025 and then Drift's AWS environment, attackers used stolen OAuth tokens for the Drift AI chat integration to export data from many customers' Salesforce instances in August 2025, hunting · seed source
  • 2026-09-25 · title: Salesloft Drift OAuth tokens stolen to raid customers' Salesforce data to Stolen Drift AI chatbot OAuth tokens used to raid customer Salesforce instances · seed source
  • 2026-09-25 · added · seed source

First seen 2026-09-25 (Research). Record counts are as reported. Not legal advice.

Everything about Salesloft

New breaches by email

Wednesdays, only in weeks with newly disclosed breaches, the largest first.

Double opt-in. Unsubscribe any time.