Google warns Salesloft breach impacted some Workspace accounts

According to Google Threat Intelligence (Mandiant) UNC6395, Google's warning that the Salesloft Drift breach is larger than first thought notes that attackers used stolen OAuth tokens to access Salesforce instances and also compromised the Drift Email integration with Google Workspace, allowing access to a very small number of Workspace email accounts.

The breach was first disclosed on 26 August after attackers stole tokens for the Drift integration with Salesforce, and on 9 August the tokens for the Drift Email integration were used to access those Google Workspace accounts. Google emphasised that no other accounts in those domains were impacted and that there has been no compromise of Google Workspace or Alphabet itself, with the stolen tokens since revoked and customers notified.

The company disabled the Drift Email integration with Google Workspace during the investigation and now urges organisations using Drift to revoke and rotate credentials for affected applications and review connected systems for signs of unauthorised access. Salesforce has disabled Drift integrations with Salesforce, Slack and Pardot until the investigation is complete, with Salesloft engaging Mandiant and Coalition to assist.