The impact of the Salesloft Drift breach on Cloudflare and our customers

According to The Cloudflare Blog, Cloudflare and hundreds of other organisations were affected by a breach that exposed text fields within Salesforce cases in Cloudflare’s Salesforce tenant between 9 August 2025 and 17 August 2025, with the attacker known as GRUB1 conducting a sophisticated supply chain–style operation targeting Salesloft Drift integrations.

The exposure was limited to Salesforce case objects and did not include attachments or files, and 104 Cloudflare API tokens were rotated as a precaution after discovery. Cloudflare’s investigation found that customer contact information, case subject lines, and body text within cases could have contained sensitive data such as keys or logs, prompting immediate credential rotation and a broader review of third‑party integrations.

Cloudflare’s response included disabling the Drift integration, revoking its client ID and secrets, and removing all Salesloft software and extensions, alongside enhanced monitoring and frequent rotation of credentials across connected services. The post also outlines recommendations for organisations, including disconnecting Salesloft from Salesforce, rotating third‑party credentials, and reviewing support case data for exposed secrets, with 104 tokens rotated in total and no evidence of broader system compromise.