Google: Salesloft Drift breach hits all integrations

Google has warned that the Salesloft Drift OAuth breach is broader than Salesforce, affecting all integrations and prompting users to treat connected tokens as potentially compromised, according to GTIG and Mandiant. Attackers used stolen OAuth tokens to access some Google Workspace emails on 9 August 2025 via the Drift Email integration, though Google stressed this did not mean a Workspace-wide compromise.

The investigation identified that the scope includes other integrations beyond the Salesforce link, with the threat actor UNC6395 exfiltrating data from Salesforce instances between 8 and 18 August 2025 to harvest credentials such as AWS access keys and Snowflake tokens. Google urged organisations to rotate credentials, review logs, and revoke API keys, noting that impacted users had their Drift Email tokens revoked and the Workspace integration disabled.

Salesforce said only a small number of customers were affected and, in coordination with Salesloft, revoked tokens, removed Drift from AppExchange, and notified impacted users. Salesloft states there is no evidence of ongoing malicious activity, while admins are told to re-authenticate integrations and a DFIR firm is assisting the investigation.