What’s Going On?
In early September 2025, a major cybersecurity ripple emerged from a sophisticated supply chain attack tied to Salesloft Drift, a popular AI chat tool integrated with Salesforce. Hackers obtained OAuth tokens, granting them unauthorized access to multiple companies’ Salesforce environments even without breaking into the Salesforce system itself.
Cloudflare Speaks Out
Cloudflare confirmed that its Salesforce powered system used to manage customer support cases was breached. Hackers managed to extract support ticket details, including sensitive logs, customer notes, and even tokens shared during troubleshooting. Fortunately, core infrastructure and platform services remained untouched.
Cloudflare’s response was swift: they revoked the compromised OAuth tokens, disabled the Salesloft integration, rotated API credentials, upgraded monitoring, and implemented stricter third party policies. Cloudflare also publicly acknowledged the incident, setting a strong example in transparency.
The Growing Fallout
This isn’t just a one off. The breach spread across hundreds of organizations, including cybersecurity giants like Palo Alto Networks, Zscaler, Proofpoint, SpyCloud, Tanium, Tenable, Workiva, and others. Most confirmed exposure of Salesforce based case objects, contact data, and metadata but emphasized that their own core systems remained uncompromised.
Google’s Threat Intelligence team traced the breach to a threat actor identified as UNC6395, while Cloudflare referred to the same group as GRUB1. The attack spanned roughly August 8 to 18, with the breach publicly disclosed around August 26.
What Makes This Incident Different?
- Not a Salesforce compromise: The attacks exploited how Salesforce connects with third party tools, not the platform itself.
- Authorized access gone rogue: Threat actors abused valid tokens, giving them seamless entry into corporate Salesforce data.
- Mass supply chain risk: With tools like Drift integrated across departments, token misuse became a widespread threat vector.
Why It Matters For You
- If you use third party integrations: Any connected app like sales tools or chatbots could expose sensitive data through your CRM unless closely audited.
- Token protection is critical: Compromised OAuth tokens can act as master keys into your cloud infrastructure.
- System transparency helps: Companies like Cloudflare that openly share breach details build trust, something all organizations should follow.
This ongoing story of the Cloudflare Salesforce Salesloft Drift breach is a powerful reminder that cybersecurity extends beyond system defenses. It is about managing the entire ecosystem of tools we rely on.
Make “authorized but compromised access” part of your threat model today. Audit every integration, rotate access tokens regularly, and treat third party connections with the same scrutiny you reserve for your own infrastructure.
Stay vigilant and informed as this story continues to evolve.