Blast Radius of Salesloft Drift Attacks Remains Uncertain

Many high-profile Salesloft Drift customers have disclosed data breaches tied to a recent supply-chain attack, but the extent and severity remain unclear. According to Google, from 8 to 18 August a threat actor (UNC6395) breached Salesloft’s Drift SaaS product by stealing OAuth and refresh tokens from its Salesforce integration, enabling lateral movement into some customer environments to steal data.

Salesloft revoked active access and refresh tokens, and Salesforce disabled all Salesloft integrations to Salesforce until further notice. The disclosure also affected other Salesloft integrations, not just Salesforce, with downstream breaches reported by Zscaler and Palo Alto Networks, followed by Proofpoint, Cloudflare, Tenable and others, though the ultimate scope remains uncertain.

In Zscaler’s disclosure, data such as names, business email addresses, job titles, phone numbers, location details, product licensing info and some plain text case content were accessible, while Cloudflare warned that some tokens and configuration details could be exposed and advised rotating credentials. Okta later highlighted that its own Salesforce instance remained breach-free due to IP restrictions, token protections and IPSIE, underscoring that reducing token misuse is key to cutting the blast radius.