BreachWatch™: Salesloft / Drift Incident

BreachWatch™: Salesloft / Drift incident

In August 2025, attackers abused OAuth and refresh tokens tied to Salesloft’s Drift integration to hop into hundreds of organizations’ Salesforce environments. It wasn’t a flaw in Salesforce itself; the compromise arrived through a trusted thirdparty app, then rode normal API pathways to pull data - often the text of support cases that can contain secrets. Google’s Threat Intelligence Group tracks the actor as UNC6395 and places active exfiltration between August 8–18, 2025. Salesforce and Salesloft revoked tokens and removed Drift from AppExchange while investigations proceeded. (Google Cloud)

If you want a single, concrete example of the modern SaaS supply-chain problem, this is it. OAuth tokens can bypass MFA, live far longer than sessions, and inherit broad scopes from over-permissive connected apps - exactly why the Drift-to-Salesforce pathway became a high-value target. (Cloud Security Alliance)

What actually happened (and why it matters)

• Entry & method. Investigations describe token theft linked to the Drift application, with the adversary using standard Salesforce APIs (including Bulk API 2.0) and then deleting jobs to reduce detection. Several firms reported exposure limited to Salesforce support case content - names, contact details, case subjects/bodies (where customers sometimes pasted tokens or logs). (Google Cloud)
• Scope. Victims include security leaders like Cloudflare, Z-scaler and Palo Alto Networks - proof that even mature programs are vulnerable when a single integration goes sideways. (The Cloudflare Blog)
• Signals to hunt. Recommended hunts include the Drift Connected App logins, UniqueQuery events, suspicious Bulk API jobs, and user-agent strings such as Salesforce-CLI/1.0, Salesforce-Multi-Org-Fetcher/1.0, and python-requests/2.32.4, plus IPs observed by responders. (Unit 42)
• This was an ecosystem failure, not “a Salesforce breach.” Salesforce’s guidance underscored that the core platform wasn’t exploited; the path was a compromised app connection leveraging legitimate tokens. (Salesforce)

For a running, vendor-verified tally of organizations that have disclosed impact, see the community tracker at driftbreach.com, which links to the companies’ official statements. (Salesloft Drift Tracker)

What Perimeter customers saw - inside the platform

Perimeter is built for exactly these supply-chain moments. When Drift disclosures began to land, customers didn’t assemble spreadsheets or chase vendors one by one. They worked the incident inside Perimeter:

• One-click triage. The platform automatically highlighted vendors with potential exposure; our risk team pretagged them so customers could filter the list instantly.
• Ready-to-send impact check. A short, prebuilt questionnaire confirmed whether Drift or connected OAuth scopes were present, and captured specifics fast.
• Action to closure. Perimeter outlined remediation steps (revoke tokens, rotate secrets discovered in case text, audit Bulk API use, etc.) and tracked closure in the same workspace.
• Verified, not just attested. Customers saw validated signals (real integration and attack-surface facts) correlated with each vendor’s claims - not just vendor promises.

Result: a real-time view across the supply chain, with validated signals funneling straight into decisioning and remediation - painless VRM in practice.

Why this fits Perimeter’s design: Our Verify module continuously measures vendors’ external footprint and correlates those signals with their responses, surfacing inconsistencies and change over time. That “zero-trust for vendor claims” is a core pillar of Perimeter’s end-to-end lifecycle approach for regulated industries and lean security teams.

Where each Perimeter module fits in this incident

• Monitor – flags news, breach chatter, and material changes tied to vendor ecosystems so you know which relationships could be affected today.
• Verify – continuously validates vendor posture using real-time attack-surface intelligence and correlates it against vendor responses to catch drift or omissions.
• Extract – parses vendor docs and notifications with citations to exact passages, accelerating review without sacrificing accuracy.
• Assess – centralizes due diligence and risk scoring so Drift-trelated exposure becomes a first-class risk signal across your program.
• Share – standardizes outbound info requests and document exchange so your “impact check” reaches vendors quickly and responses stay auditable.
• Respond – orchestrates RFPs and remediation tasks with clear owners and SLAs; every token rotation and app disconnect is tracked to closure.

Perimeter’s promise is simple: end-to-end, low-effort, real-time VRM that validates vendor claims rather than trusting them by default - exactly what incidents like Drift demand. (Customers regularly achieve rapid time-to-value as programs come online.)