PagerDuty Confirms Data Breach After Salesforce Account Compromise

PagerDuty confirms a data breach following a compromise of its Salesforce account, with the incident first flagged by Salesloft on 20 August 2025 and subsequently linked to Drift’s OAuth integration flow with Salesforce. According to Salesloft, attackers exploited the Drift OAuth vulnerability, and through that hijacked authorization process a threat actor may have gained unauthorized access to PagerDuty’s Salesforce data.

Importantly, PagerDuty states that no PagerDuty credentials, such as usernames or passwords, were exposed during the incident. PagerDuty has since disabled Salesloft Drift’s access to its Salesforce data while the investigation continues, and the company has found no evidence that the attacker accessed the PagerDuty platform or internal systems beyond Salesforce.

Because names, phone numbers, and email addresses stored in Salesforce may have been exposed, PagerDuty has urged customers and contacts to remain vigilant and notes an increased risk of phishing and social engineering. Background and technical details of the security issue have been shared by Salesloft, Salesforce, and the Google Threat Intelligence Group, according to those sources.