Google Confirms Workspace Accounts Also Hit in Salesforce–Salesloft Drift Data Theft Campaign

Google says the same OAuth token compromise that enabled Salesforce data theft also allowed attackers to access a small number of Google Workspace accounts via the Salesloft Drift integration. The campaign was carried out between 8 August and 18 August 2025, with GTIG warning the attackers likely harvested credentials by exporting data from Salesforce instances. The attackers were seen searching for AWS access keys, passwords and other sensitive tokens, and UNC6395 has been named as the threat actor.

In an update on 28 August, GTIG revealed that Google Workspace customers had been affected as well; on 9 August 2025, a threat actor used these tokens to access email from a very small number of Google Workspace accounts. After identifying impact, Google revoked the Drift Email OAuth tokens and disabled the Workspace integration with Salesloft Drift, stressing that there has been no compromise of Google Workspace or Alphabet itself according to Google Threat Intelligence Group.

All organisations using Drift should review their third‑party integrations, rotate credentials, and search connected systems for signs of compromise, while Salesloft notified customers to revoke API keys and reconnect with new keys.