Salesloft Drift Breach Exposes Customer Data, Impacting Major Tech Companies

The Salesloft Drift Breach: A Supply-Chain Attack Unfolds

In a significant cybersecurity incident, Salesloft's AI-powered marketing platform, Drift, has been compromised, leading to a supply-chain attack affecting numerous high-profile tech companies. The breach, which began with a hack of Salesloft's GitHub account in March, has exposed sensitive customer data and raised questions about the security practices of affected organizations 1

1

.

Timeline and Scope of the Attack

The attack unfolded over several months, with hackers gaining access to Salesloft's GitHub account in March and conducting reconnaissance activities until June. During this time, they downloaded content from multiple repositories, added a guest user, and established workflows 1

1

. The prolonged access raises concerns about Salesloft's security posture and detection capabilities.

Impact on Major Tech Companies

Several prominent tech companies have been affected by the breach, including:

1. Zscaler
2. Bugcrowd
3. Cloudflare
4. Google
5. Proofpoint
6. Palo Alto Networks
7. Tenable

The full extent of the impact remains unknown, with potentially more affected companies yet to be identified 1

1

.

Mechanism of the Attack

The attackers exploited OAuth tokens associated with Drift's integration with Salesforce. This allowed them to access Salesforce instances of Drift's customers and exfiltrate sensitive data, including:

• Names and business email addresses
• Job titles and phone numbers
• Regional and location details
• Product licensing and commercial information
• Content from support cases 2

  2

Attribution and Threat Actor Identification

Google's Threat Intelligence Group (GTIG) has attributed the attack to a hacking group known as UNC6395 2

2

. However, some cybersecurity publications and researchers have linked the breach to the prolific hacking group ShinyHunters, known for their extortion attempts 1

1

.

Broader Implications and Related Incidents

The Salesloft Drift compromise has also impacted Drift Email, used for managing email replies and organizing CRM and marketing automation databases. Attackers have reportedly used stolen OAuth tokens to access Google Workspace email accounts 2

2

.

Response and Mitigation Efforts

Affected companies are taking steps to mitigate the risks associated with the breach:

1. Zscaler has revoked all Salesloft Drift integrations and rotated API tokens 3

   3

   .
2. Google and Salesforce have temporarily disabled their Drift integrations pending investigation 2

   2

   .
3. Companies are strengthening customer authentication protocols for support calls to guard against social engineering attacks 4

   4

   .

Lessons and Future Implications

This incident highlights the critical importance of supply-chain security and the potential risks associated with third-party integrations. Organizations are advised to review their security practices, particularly concerning OAuth token management and access controls for cloud-based services.