Salesforce Breach Through Salesloft Drift Hits Google, Cloudflare, and 750 Firms

Beginning in July 2025, several high-profile organisations reported breaches of their Salesforce CRM systems after attackers gained access and exfiltrated data, the Daily CyberSecurity reports. Among those affected were Google and Cloudflare, whose CRM databases were compromised, with the breaches ultimately traced to hackers exploiting vulnerabilities in Salesloft’s Drift platform to obtain Salesforce access.

On 9 September 2025, a security update disclosed that attackers had targeted Salesloft’s GitHub repositories as early as March through June of that year and had succeeded, enabling data download, new user creation, and automated workflows. The attackers also compromised Salesloft Drift’s AWS environment, gaining OAuth credentials belonging to customers such as Cloudflare and Google, which allowed them to siphon data consolidated through the Drift platform.

According to an investigation by Nudge Security, the current estimate is that at least 750 Salesloft customers were compromised, with many organisations potentially unaware of the theft until extortion emails begin arriving.