More Cybersecurity Firms Hit by Salesforce-Salesloft Drift Breach

Proofpoint, SpyCloud, Tanium, and Tenable have confirmed that information in their Salesforce instances was compromised as part of the Salesforce–Salesloft Drift attack, with attackers accessing data stored in those tenants. The campaign, publicly disclosed on 26 August 2025, when Google’s threat intelligence team reported that a threat actor tracked as UNC6395 exported large volumes of data using compromised OAuth tokens for Salesloft Drift, is said to have targeted hundreds of organisations.

The attack, according to Google, exploited the Salesforce-Salesloft Drift integration to steal data such as AWS access keys, passwords, and Snowflake-related access tokens, and it was later found to affect other Salesforce customers as well. On 28 August 2025, Workspace customers were reported as affected, with further disclosures from Cloudflare, Palo Alto Networks, and Zscaler shortly after.

Overall, the incident is estimated to have hit over 700 organisations, with Proofpoint noting that attackers viewed information in its Salesforce tenant and that SpyCloud, Tanium, and Tenable reported compromised customer relationship data and other personal details. Tenable added that there was no evidence of misuse of stolen information and that it rotated credentials, removed the application, and secured its systems.