Salesloft Drift OAuth supply-chain breach hits Cloudflare, Palo Alto Networks, Zscaler and others

Between roughly 9 and 17 August 2026, an intrusion set that Google/Mandiant tracks as UNC6395 systematically abused stolen OAuth tokens belonging to Salesloft's Drift — an AI chatbot that integrates with Salesforce — to reach into the Salesforce environments of hundreds of organisations. Starting on 2 September 2026, a wave of major security and technology companies publicly confirmed that their data had been swept up, turning a single third-party integration into one of the year's largest supply-chain compromises.

The named victims read like a roster of the security industry itself, including Cloudflare, Palo Alto Networks, Zscaler, SpyCloud, Tanium, Proofpoint and, in follow-on disclosures, Workiva — with reporting placing the total number of affected organisations at more than 700. In most cases the companies stressed that the exposure was confined to data stored in Salesforce — principally business contact information, support-case text, and account records — and did not touch their core products, source code or customer-facing infrastructure.

A credential-harvesting operation

Investigators characterised the campaign as a credential-harvesting exercise rather than opportunistic data theft. The attackers used automated Salesforce Object Query Language (SOQL) queries, bulk exports and custom user-agent strings to blend in, then combed the exfiltrated support-case text for secrets — plaintext AWS keys, VPN credentials, Snowflake tokens and similar material that could unlock deeper follow-on intrusions. That focus made the incident dangerous well beyond the contact records themselves.

Containment across the ecosystem

In response, Salesloft and Salesforce revoked the affected Drift tokens and disabled the integration while the investigation proceeded, and individual victims rotated exposed secrets and notified customers. Because the intrusion was scoped to Salesforce data accessed through a now-revoked integration — and no victim reported compromise of its production systems — the campaign was broadly assessed as contained, even as the sheer number of downstream organisations and the credential-harvesting angle kept remediation work running for weeks. The activity was later publicly linked by extortion actors operating under the ShinyHunters banner.