INSIGHTS
Salesloft Drift, 700 organisations: aggregation through a SaaS integration
Between 8 and 18 August 2025 tokens stolen from Salesloft's Drift assistant gave access to the Salesforce data of more than 700 organisations, many of them security vendors. The analysis: OAuth authorisations, secrets in the CRM, aggregation, supplier liability and questions for renewals.
Archive: reconstruction written in November 2026
Topic of the month, August 2025 · by cybercoverinsurance
Between 8 and 18 August 2025 a group Google calls UNC6395 used authorisation tokens stolen from Drift, a sales chat assistant from Salesloft, to enter customers' Salesforce environments and copy their data. Google estimated more than 700 organisations potentially affected. Companies that confirmed being hit include Cloudflare, Palo Alto Networks, Zscaler, Proofpoint and other security vendors. The origin was a Salesloft GitHub account breached months earlier.
For cyber underwriters the case is an example of aggregation through a SaaS integration. The attackers neither bypassed the victims' access controls nor exploited a Salesforce flaw: an authorised connection between two cloud services was enough. It raises three questions: what the data in a CRM is worth, who is liable when the integration supplier is breached, and how to count an event that touches hundreds of insureds in ten days.
What is known
The attack. According to Google Threat Intelligence, the campaign ran from at least 8 to 18 August 2025. The attackers stole Drift OAuth tokens and used them to access customer data in Salesforce and export it, with an automated tool. In the data they searched for plaintext credentials, AWS access keys, VPN and Snowflake credentials, to reach other victim systems. Google advised customers to treat the data as compromised, search Salesforce instances for secrets and rotate credentials. Salesforce stated it was not a flaw in its platform (CyberScoop).
The scale. Google indicated more than 700 potentially affected organisations. Salesforce disabled all Salesloft integrations as a precaution and Salesloft took Drift offline. Companies that confirmed being hit include BeyondTrust, Cloudflare, CyberArk, Elastic, Palo Alto Networks, Proofpoint, Qualys, Rubrik, Tenable, Workday and Zscaler. Cloudflare said it believed the aim was to harvest credentials and information for later attacks on the victims' customers (The Hacker News).
The origin. According to Mandiant's investigation as reported by Salesloft, the attacker had access to Salesloft's GitHub account between March and June 2025. It downloaded content from several repositories, created workflows and carried out reconnaissance in the Salesloft and Drift environments. It then entered Drift's AWS environment and obtained the OAuth tokens for customers' integrations. In early September the Salesloft integration with Salesforce was restored, while Drift remained disabled (Cybersecurity Dive).
What is not known. How many organisations actually had data exported, and whether the harvested credentials were used, is not public. Mandiant said it had not seen further use in ongoing investigations (CyberScoop). Total costs are not known.
The token is a key nobody watches
An authorised connection, not an intrusion. Each customer had authorised Drift to read Salesforce data. The attackers did not have to defeat multi-factor authentication or access controls: they used an authorisation already granted. To the victims, the access looked like an application's normal traffic.
A CRM holds more than business contacts. The attackers searched Salesforce data for credentials and keys. Support tickets can contain passwords, keys and configurations pasted by customers and engineers. A CRM with support data is therefore also a store of secrets, and a breach can open other systems.
The breached supplier sat upstream of a supplier. Salesloft had been breached on GitHub months earlier, then in Drift's AWS environment. For customers, the risk came from the supplier of an application connected to another supplier. This chain does not appear in most supplier assessments.
Aggregation through an integration
Seven hundred organisations in ten days. The same event touched hundreds of companies, many of them large and with cyber policies. It is the MOVEit and Cleo pattern applied to SaaS: one common component, many victims, data taken in a short time.
The typical loss is small, the sum is not. For many victims the exported data was business contacts and support tickets. Typical costs are investigation, credential rotation, data review and, where personal data is involved, notification. Each claim may stay below the retention, but hundreds of simultaneous investigations weigh on a portfolio and on the capacity of incident response providers.
Security vendors as multipliers. Many confirmed victims were security companies. If the attackers use the harvested data against their customers, as Cloudflare feared, aggregation can spread to a second level. For underwriters, a breach at a security vendor is an event to follow even when the vendor is not an insured.
Who is liable
The integration supplier's liability. Salesloft was the breached supplier. Customers can seek recovery from Salesloft under their contracts, but liability caps in SaaS contracts are usually low compared with hundreds of claims. For insurers that paid customers, subrogation against Salesloft runs into the same limits.
The definition of computer system matters. Many policies cover the insured's systems and those operated by suppliers on its behalf. A Salesforce environment usually falls in the second category. Drift's environment, a supplier's supplier, is less certain. The difference decides which loss items are covered as a first-party breach.
What to bring to renewals
Impact for insurersHigh
Tokens stolen from a chat application connected to Salesforce gave access to the data of more than 700 organisations in ten days, without exploiting Salesforce flaws or defeating the victims' access controls.
On the portfolio side, the case suggests treating the most widespread SaaS integrations as aggregation points, on a par with the large cloud providers. A scenario with hundreds of simultaneous investigations and low unit costs is useful for testing response capacity, aggregate limits and single-event clauses.