What happened?

From Aug 8 to 18, 2025, 700+ organizations using Drift suffered wide-spread data theft: A group Google tracks as UNC6395 abused compromised OAuth tokens from the Drift↔Salesforce integration to access orgs and exfiltrate data.

On Aug 20, Salesloft and Salesforce revoked Drift tokens, and Salesforce removed Drift from AppExchange pending investigation. Then on Aug 28 Google reported other Drift integrations were also abused (e.g., Drift Email↔Google Workspace); Google revoked Drift tokens and the integration was disabled.

Why does this matter?

OAuth tokens are non-human identities. When scopes are broad or tokens are long-lived, compromise becomes a high-throughput data-exfiltration channel. Then, as observed here, a credential-harvesting operation aimed at pivoting into other systems (AWS, Snowflake, etc.) becomes a data catastrophe. This is a stark reminder to treat connected apps as first-class identities with least privilege and short lifetimes, else organizations should be ready to accept outsized blast radius when things go wrong.

What to do in 24 to 72 hours?

1. Revoke & rotate: Revoke Drift tokens and rotate all downstream secrets (API keys, access tokens, passwords), including any secrets stored in Salesforce objects.
2. Audit scopes & access: Remove overly permissive all connected-app scopes, enforce IP restrictions, and shorten session/token lifetimes; re-authenticate only with minimum required scopes.
3. Interrogate logs: Use Event Monitoring to review auth events and query activity for the Drift connection user; investigate anomalous exports.
4. Broaden the blast-radius check: If you used any Drift integration (not just Salesforce), review and rotate there, too and Google disabled Drift Email↔Workspace for this reason.

What to institutionalize?

1. Least-privilege OAuth for apps. Scope each integration to the exact objects/permissions it needs.
2. Short-lived tokens + automated rotation. Engineer away long-lived credentials; rotate on a schedule and on signal.
3. Network-aware controls. Enforce IP allow-lists for Connected Apps and service users to curtail token misuse from arbitrary locations.
4. Secrets hygiene in CRM. Search and evict credentials from records/attachments to a vault; rotate anything discovered.
5. Observability for non-human identities. Alert on unusual object access patterns and query volumes from app users.

Get more value safely.

Security should enable GTM, not slow it down. A security-first design lets you implement higher-signal buyer experiences (better qualification, cleaner routing, seller co-pilot assistance) without risking losing your customer data.

Vurbalize connects with:

1. Scoped access per capability. GenAI chat, live-agent handoff, and seller tools each run with separate, minimal scopes.
2. Per-tenant isolation & full audit trails. Every action, whether it is lead creation, enrichment, meeting booking, it is traceable to a least-privilege app identity.
3. Operational guardrails. IP allow-listing, rate limits, and egress controls block the kind of high-volume exfiltration used here.

With a security first approach across GenAI Chat, Live-Agent Connect, and Seller Co-Pilot, Vurbalize delivers safer operations and higher-quality leads at lower CAC.

We Want to Help.

Get a Complimentary connected-app security audit (no pitch). We'll review scopes, service users, logs, and leave you with a concrete hardening checklist.

Or

Get a Migration plan to a safe, prolific, high-value GTM platform. We'll map current flows to a least-privilege, token-hygienic architecture that typically improves lead quality and ROI.

Vurbalize isn't affiliated with Salesforce, Google, or Salesloft. Shared to support remediation and resilience.

Sources

https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift?
https://www.helpnetsecurity.com/2025/08/27/hundreds-of-salesforce-customer-orgs-hit-in-clever-attack-with-potentially-huge-blast-radius/
https://www.cybersecuritydive.com/news/hackers-steal-data-salesforce-instances/758676/?

Recovering from Drift-Salesforce Data Breach — What it Teaches Us