Cyber Insights: SalesLoft Drift

FAQs about the SalesLoft Drift Attack

• 1. What happened in the Salesloft Drift cyber attack?

  The Salesloft Drift cyber attack was a supply-chain compromise in which attackers obtained OAuth credentials associated with Drift’s third-party integrations. These credentials were subsequently used to access and exfiltrate data from connected customer environments, including numerous Salesforce instances. 

• 2. When did the Salesloft Drift cyber attack take place?

  The main data-exfiltration campaign occurred between approximately 8 and 18 August 2025. However, the wider intrusion reportedly began earlier, when the threat actor accessed Salesloft’s GitHub environment and conducted reconnaissance between March and June 2025. 

• 3. How did the attackers compromise Salesloft Drift?

  The investigation found that the attackers initially gained access to Salesloft’s GitHub account. They later accessed Drift’s AWS environment and obtained OAuth tokens belonging to customer integrations. These stolen tokens enabled them to access connected systems without needing users’ passwords. 

• 4. Who was responsible for the Salesloft Drift cyber attack?

  Google Threat Intelligence Group tracks the threat actor responsible for the campaign as UNC6395. This is a temporary designation used to identify and monitor the group’s malicious activity; it does not necessarily confirm the attackers’ real-world identity or organisational affiliation. 

• 5. What information was targeted in the Salesloft Drift breach?

  The attackers exported substantial volumes of CRM data, including information stored in Salesforce Accounts, Cases, Users and Opportunities. They also searched the stolen data for credentials and secrets such as AWS access keys, Snowflake tokens, API credentials and plaintext passwords. 

• 6. Was the Salesforce platform itself compromised?

  The incident was not attributed to a vulnerability in Salesforce’s core platform. Attackers accessed individual customer environments by abusing OAuth tokens associated with the compromised Drift integration, demonstrating how a trusted third-party connection can become an indirect route into business-critical systems. 

• 7. What should organisations do following the Salesloft Drift incident?

  Potentially affected organisations should review every application connected to their Drift environment, revoke and rotate OAuth tokens, API keys, passwords and other exposed credentials, and examine authentication and event logs for suspicious activity. Connected applications should also be restricted according to least-privilege principles. 

• 8. What does the CMA Cyber Insights document cover?

  The CMA Cyber Insights document examines the attack timeline, initial compromise, exploitation of OAuth tokens and the wider impact on connected organisations. It also provides actionable recommendations, sector-specific considerations and best-practice measures for improving third-party risk management, incident response and operational resilience.