Proofpoint, Tenable and CyberArk confirmed unauthorized access to information stored in their Salesforce environments during the 2025 Salesloft Drift incident. The disclosed access came through compromised OAuth credentials associated with the Drift application, which was connected to customer Salesforce organizations.
This was not reported as a compromise of the three companies’ security products, services or internal corporate networks. It was a third-party SaaS-integration incident: attackers abused a trusted connection to reach Salesforce-held data. The distinction matters because the response requires more than changing user passwords—it requires revoking OAuth tokens, reviewing API activity and assessing information stored in CRM records.
What happened in the Salesloft Drift–Salesforce incident?
The attack chain depended on the trust relationship between Salesloft’s Drift application and customer Salesforce organizations:
- An organization connected Drift to Salesforce.
- Drift received OAuth authorization, including credentials or refresh-token authority that allowed it to access specified Salesforce data.
- Attackers obtained or abused credentials associated with the Drift integration.
- They replayed those credentials against connected Salesforce environments.
- They searched for and exported information from customer CRM records.
Salesloft identified activity primarily between August 8 and August 18, 2025. Google tracked the activity as UNC6395, and the FBI described the group’s use of compromised Salesloft Drift OAuth tokens against Salesforce environments.
Free tools Windows power users keep installed
One-click scans. No signup required.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
The attacker did not need to break into every victim’s network separately. A compromised connected application provided a path into data that organizations had made available to Drift. That is why the event is commonly described as a SaaS, SaaS-integration or supply-chain compromise.
What information was exposed?
The three companies did not report identical exposure. “Accessed” also does not necessarily mean that every accessible record was copied or misused. The public descriptions should therefore be read as company-specific exposure summaries, not as evidence that all three organizations lost the same types of data.
| Company | Information described as accessed or potentially accessible | Information the company said was not affected |
|---|---|---|
| Proofpoint | Salesforce case objects, including limited contact information such as a small number of customer employee names and business email addresses. | Email messages, attachments, sensitive configuration data, Proofpoint software, customer-protected data and its internal corporate network. |
| Tenable | Support-case subject lines and initial descriptions, plus standard contact information including names, business email addresses, phone numbers and location references. | Tenable products and data stored in Tenable products. |
| CyberArk | Business contact information, account metadata, conversation metadata and summary fields. | Support-case information, CyberArk products and services. |
Proofpoint
In its September 2, 2025 incident-response statement, Proofpoint said an unauthorized actor accessed its Salesforce tenant and viewed certain information. Proofpoint characterized the affected Salesforce case objects as containing limited contact information, including a small number of customer employee names and business email addresses.
Proofpoint said the incident did not affect email messages, attachments, sensitive configuration data, Proofpoint software, customer-protected data or its internal corporate network. Those exclusions are important: access to selected Salesforce records is not the same as access to Proofpoint’s production security platform or a customer’s protected environment.
Recommended Free Tools
Tenable
Tenable reported that an unauthorized user accessed part of some customers’ information stored in its Salesforce instance. The described information included support-case subject lines and initial descriptions, along with customer names, business email addresses, phone numbers and location references.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Tenable said its products and data stored in Tenable products were not affected. The public description does not establish that every support record or every customer represented in the Salesforce instance was accessed.
CyberArk
CyberArk confirmed that it was among the organizations affected. The information potentially accessible through its Salesforce environment included business contact information, account metadata, conversation metadata and summary fields.
CyberArk said support-case information, its products and its services were not affected. “Potentially accessible” should not be converted into a claim that every listed field was exfiltrated.
Was Salesforce itself hacked?
Salesforce said the incident did not result from a vulnerability in the core Salesforce platform. Its characterization was that the Drift connection was disabled after a security incident involving the third-party integration.
Salesforce disabled the Drift connection on August 27, 2025. On August 28, it disabled integrations between Salesforce and Salesloft technologies as a precaution. According to the later status shown on Salesforce’s incident-response material, other Salesloft integrations had been re-enabled while Drift remained disabled.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
The most precise description is therefore: Salesforce customer environments were accessed through a compromised third-party Drift integration. Saying simply that “Salesforce was breached” can incorrectly suggest that attackers exploited Salesforce’s core infrastructure.
Organizations should still treat this as a serious Salesforce security event. A connected application can hold broad access to CRM objects, and the resulting exposure depends on the permissions, tokens, records and logs available in each organization.
Why the exposed data still matters
Names, business email addresses and account metadata may appear ordinary, but CRM records can provide attackers with valuable context:
- Targeted phishing: Contact details can support convincing messages impersonating vendors, support teams or executives.
- Social engineering: Conversation summaries and account relationships can help an attacker sound familiar with a company’s business.
- Technical reconnaissance: Support-case subjects and descriptions may mention products, integrations, error messages, architecture, incidents or vulnerabilities.
- Workflow mapping: Account metadata can reveal who handles security, procurement, support or renewals.
- Extortion leverage: Customer relationships and support history can be used to pressure a vendor or its customers.
The public disclosures for Proofpoint, Tenable and CyberArk do not establish that passwords, cloud keys, API secrets or customer production environments were exposed. Those possibilities should be investigated where relevant, but they should not be presented as confirmed facts about these three companies.
How broad was the campaign?
The three disclosures were part of a wider campaign involving organizations that used Salesloft technologies with Salesforce. Reports also identified organizations including Google, Cloudflare, Zscaler, Palo Alto Networks, Rubrik, Tanium, BeyondTrust, Nutanix, Qualys, Elastic, JFrog and Cato Networks.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
FINRA cited more than 700 organizations when describing the reported scale of the incident. That is a campaign-scale figure, not a finding that every organization had the same level of access or data loss.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteMuch larger claims—including claims involving 1.5 billion Salesforce records—were attributed to threat actors and have not been independently established as a total for this incident. Such figures should not be treated as verified victim or stolen-record counts.
What affected organizations should do
Organizations that used Drift with Salesforce during the exposure period should treat OAuth credentials as the central containment issue.
- Disable unnecessary connected applications. Remove or suspend Drift and other Salesloft-connected applications if they are not required.
- Revoke OAuth access and refresh tokens. A password reset alone may not invalidate independently issued application tokens.
- Review granted scopes. Determine which Salesforce objects and actions the application could access, including custom objects.
- Rotate exposed secrets. Prioritize cloud keys, API keys, passwords, service credentials and third-party tokens that may have appeared in Salesforce records or attachments.
- Review Salesforce activity. Examine login history, connected-app activity, API calls, bulk API use, report exports and unusual access from unfamiliar IP ranges.
- Search CRM data for secrets. Inspect case notes, descriptions, attachments, custom fields and conversation records for credentials or sensitive infrastructure details.
- Preserve evidence. Retain relevant logs, token records, exports and administrative changes for legal, regulatory and insurance needs.
- Prepare for follow-on phishing. Warn employees and customers that attackers may use legitimate account names, support subjects or case context in convincing messages.
- Assess notification duties. Legal and regulatory obligations depend on the affected data, jurisdictions, contracts and whether individuals can be identified.
- Reauthorize carefully. Do not reconnect Drift or another integration merely because service availability has returned. Require vendor remediation, scope review and internal approval first.
Organizations should not automatically reset every password without evidence. The priority is to revoke application authority and rotate credentials that were stored in, reachable from or associated with the affected Salesforce environment.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What Salesforce administrators should check
Exact menu names and available logs vary by Salesforce edition, licensing and configuration, so there is no single universal investigation path. Administrators should review the following areas using the controls available in their organization:
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Connected Apps and OAuth authorizations
- Application permissions and OAuth scopes granted to Drift or Salesloft applications
- Login history and API access records
- Bulk API activity and report or data exports
- Unfamiliar IP ranges, locations or access patterns
- Salesforce cases, custom objects, notes and attachments containing credentials or technical details
- Administrative and permission changes during and immediately after August 8–18, 2025
- Whether an integration was automatically reauthorized or reconnected after Salesforce controls changed
Salesforce logs are not necessarily complete for every organization. Retention periods, event-monitoring features and available audit data differ, so investigators should record what data is available and identify gaps rather than assuming that an absence of logs proves an absence of access.
What this incident means for SaaS security
Connected applications deserve supply-chain treatment
Vendor-risk reviews often focus on the vendor’s own network and software. This incident shows why the permissions and tokens granted to connected SaaS applications matter just as much. A trusted application may become the attacker’s route into another platform without the primary platform itself being vulnerable.
Least privilege must include data objects
Organizations should limit connected applications to the Salesforce objects and actions they actually need. Broad read access to cases, contacts, accounts, notes and custom objects can create substantial exposure even when the application does not have permission to modify production systems.
Support systems can contain sensitive intelligence
Case descriptions frequently include error messages, URLs, usernames, system names and details about incidents. Employees should avoid placing passwords, private keys and reusable tokens in support records. Secrets that must be shared should use an approved secret-management or secure-sharing process.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Token governance is as important as password governance
OAuth grants and refresh tokens can survive a password reset. Organizations need an inventory of connected applications, a process for revoking unused grants and monitoring for unusual API use. Token lifetime, reauthorization and scope should be part of SaaS security reviews.
Bottom line
Proofpoint, Tenable and CyberArk were affected by unauthorized access to Salesforce-held information through the compromised Salesloft Drift integration. Their public statements did not describe a compromise of their security products, services or internal networks.
The incident is best understood as a third-party OAuth and SaaS-integration compromise—not as evidence that Salesforce’s core platform was exploited. For organizations using Salesforce, the practical lesson is clear: revoke connected-app tokens, inspect API and export activity, search CRM records for secrets, rotate credentials that may have been exposed and prepare for targeted phishing based on stolen business context.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problems
