Qualys Confirms Cyberattack Campaign Targeting Salesforce via Salesloft and Drift

Qualys has confirmed that it was recently impacted by a cybersecurity campaign targeting Salesloft and Drift, two third‑party SaaS platforms that integrate with Salesforce. The attack centred on stealing third‑party OAuth tokens linked to Drift, allowing attackers restricted access to Salesforce information and affecting multiple Salesloft customers, including Qualys.

While Salesforce data was exposed, the breach was contained to a narrow information scope and did not compromise Qualys’ cloud infrastructure, production environments, agents, scanners or core codebase. According to Qualys, the company activated its incident response, disabled all Drift integrations with its Salesforce environment, and launched a forensic investigation with Salesforce, assisted by external experts from Mandiant.

Ongoing monitoring and enhancements to security controls around third‑party integrations have been promised, with transparency and prompt customer notification emphasised if further developments arise. The incident underscores the growing risk to interconnected cloud ecosystems, even when primary platforms remain secure, and the firm stressed that its essential services continued to operate without disruption on 9 September 2025.