GitHub Account Compromise Led to Salesloft Drift Breach Affecting 22 Companies

According to Mandiant, the data breach tied to Salesloft’s Drift application began with the compromise of Salesloft’s GitHub account. The threat actor, tracked as UNC6395, accessed the Salesloft GitHub account from March through June 2025, and 22 companies have confirmed they were impacted by the supply chain breach. With this access, the attacker was able to download content from multiple repositories, add a guest user, and establish workflows, as Salesloft stated in an updated advisory.

Reconnaissance activities were detected between March 2025 and June 2025 in the Salesloft and Drift environments, though there was no evidence of activity beyond limited reconnaissance. In the next phase, the attackers accessed Drift’s AWS environment and obtained OAuth tokens for Drift customers’ integrations, using the tokens to access data via Drift integrations.

Salesloft isolated the Drift infrastructure, took Drift offline on September 5, 2025, and rotated credentials, with Salesforce subsequently restoring most integrations by September 7, 2025, while Drift remained disabled.