Stolen Drift Tokens Drain Salesforce Data

Software agent · AI chat agent integration · Found first by not disclosed

A group Google tracks as UNC6395 stole OAuth tokens held by Salesloft's Drift AI chat agent and used them to pull Salesforce data from more than 700 organizations, including Cloudflare, Zscaler and Palo Alto Networks. An AI chat agent's stored tokens gave attackers one route into hundreds of customer systems, so the agent vendor's security became every customer's exposure.

Timeline of Stolen Drift Tokens Drain Salesforce Data: Mar 2025, Attackers enter Salesloft GitHub; Aug 8, Bulk Salesforce exports begin; Aug 20, All Drift tokens revoked; Aug 26, Google attributes it to UNC6395. Below, the reporting rules that applied: State breach laws, applied; California SB 53, not applicable. FROM THEFT TO REVOCATION APR 1 MAY 1 JUN 1 JUL 1 AUG 1 SEP 1 MAR 2025 Attackers enter Salesloft GitHub AUG 8 Bulk Salesforce exports begin AUG 20 All Drift tokens revoked AUG 26 Google attributes it to UNC6395 REPORTING RULES AND THIS INCIDENT State breach laws CUSTOMERS FILED NOTICES APPLIED California SB 53 NOT A FRONTIER MODEL NOT APPLICABLE
Agent class
Software
Developer
Salesloft (Drift)
Deployers
More than 700 Salesforce customers
Found first by
Not disclosed
Date
Aug 2025
Organizations hit
700+

What happened

An AI Agent's Tokens Opened Hundreds of CRMs

  • Entry: attackers were in Salesloft's GitHub from March to June 2025, then reached Drift's AWS environment and its customer tokens.
  • Theft: bulk queries pulled cases, accounts, users and opportunities from August 8 to 18.
  • Aim: Google assessed the main goal as harvesting AWS keys, passwords and Snowflake tokens stored in records.
  • Cover: the actor deleted query jobs, but Salesforce logs survived.

Timeline

Ten Days of Theft, Then Every Token Revoked

Timeline
DateEventSource
March 2025Attackers first get into Salesloft's GitHub environmentMandiant
August 8, 2025UNC6395 begins exporting data from Salesforce instancesGoogle Threat Intelligence Group
August 20, 2025Salesloft and Salesforce revoke Drift tokens and disclose the problemTechTarget
August 26, 2025Google Threat Intelligence Group publishes its advisoryGoogle Cloud
August 28, 2025Google says all Drift-linked tokens, including Workspace, should be treated as compromisedGoogle Cloud

Controls that failed

The Agent Held Broad, Long-Lived Access

Controls that failed
ControlCompanyWhat failed137AI page
Vendor environment securitySalesloftAttackers reached Drift's AWS environment and its customer tokensSupply Chain of Updates
Connected-app scopeCustomersDrift's tokens allowed broad bulk queriesAccess and Authorization
Secrets in recordsCustomersCredentials stored in CRM records let attackers reach further systemsAccess and Authorization

Reporting

Breach Laws Fell on the Customers

Reporting rules and this incident
RuleStatusWhy
State breach lawsAppliedAffected companies, such as OneDigital, filed state breach notices
California SB 53Not applicableDrift is not a frontier model developer

Every rule tracked is on Incident Reporting Rules and Registries.

Response

Tokens Revoked and Drift Pulled

  • Regulators and courts: Affected companies filed state breach notices, including a Maine filing covering up to 28,414 people. No regulator action against Salesloft was found.
  • Remediation: Salesloft and Salesforce revoked all Drift tokens on August 20, 2025; Salesforce pulled Drift from AppExchange, Google disabled the Workspace integration, and Salesloft brought in Mandiant.

Record

Incident Record

Incident ID
2025-08-SALESLOFT-DRIFT
Sources
Google Threat Intelligence Group (August 2025); BleepingComputer (September 2025); TechTarget (2025)
Last verified
October 2026