SolarWinds Issues Advisory on Salesforce Data Breach Linked to Salesloft Drift

SolarWinds has issued a security advisory about a major Salesforce data breach that exposed sensitive information from numerous companies, though SolarWinds itself says its systems were not impacted. According to SolarWinds’ advisory, the breach was primarily caused by compromised OAuth tokens linked to the Salesloft Drift integration, enabling attackers to export data from multiple Salesforce customer instances and targeting sensitive credentials such as access keys and passwords.

The attackers’ techniques were observed by Google Threat Intelligence (Mandiant), which noted the principal target appeared to be secrets that could be used to compromise victim environments, and that the group — tracked as UNC6395 — specifically sought AWS access keys, Snowflake tokens, and user passwords. The scale of the campaign prompted an FBI advisory warning about the UNC6040 and UNC6395 threat actors, with IOCs shared from the attacks.

While SolarWinds emphasises its lack of involvement, the breach has impacted several major organisations, including Google, Cloudflare, Zscaler and others. 18 September 2025.