The Ongoing Fallout from a Breach at AI Chatbot Maker Salesloft

The Krebs on Security report details a mass-theft of Salesloft authentication tokens. According to Google Threat Intelligence Group, the attackers used the stolen tokens to siphon data from Salesforce instances and to access tokens for hundreds of integrated services such as Slack, Google Workspace, Amazon S3, Microsoft Azure and OpenAI. Google said the data theft began as early as 8 August 2025 and continued through at least 18 August 2025, with Salesforce blocked from Drift integration by 28 August 2025.

Salesloft, which says its platform is trusted by 5,000+ customers, disclosed on 20 August that a security issue in the Drift application was detected, prompting re-authentication between Drift and Salesforce. The GTIG advisory urged organisations using Salesloft Drift to immediately invalidate all tokens connected to their integrations, given evidence of data exfiltration and credential material discovery.

Mandiant was hired on 27 August 2025 to investigate the incident, while researchers note uncertain attribution to ShinyHunters or other known groups at this time.