Lessons from the Drift/Salesloft Breach: A 2025 Wake-Up Call for Third-Party Risk Management

5 minute read

September 2025

by Kaitlyn Frank

When news broke in September 2025 that Drift and its parent company Salesloft had suffered a significant breach, the story quickly dominated cybersecurity headlines. Beyond the technical details, the incident illustrates a sobering reality for today’s enterprises. In a SaaS-driven world, your security is only as strong as the vendors and integrations you rely on.

Let’s review what happened, why it matters, and how companies can strengthen their defenses when third-party breaches inevitably occur.

What Happened: From GitHub to Salesforce Data Theft

The attack unfolded in several stages:

  • March–June 2025: Attackers compromised Salesloft’s GitHub environment by adding a guest user, creating rogue workflows, and setting the stage for deeper access.
  • Pivot to Drift: Using that foothold, they infiltrated Drift’s AWS environment and stole OAuth tokens tied to customer integrations, such as Salesforce.
  • August 8–18th: With valid tokens in hand, the attackers ran bulk queries and exports from Salesforce instances across hundreds of organizations. They targeted objects like Accounts, Users, and Support Cases, harvesting sensitive business and customer data, including credentials embedded in case text.
  • Containment: On August 20th, Salesforce revoked Drift tokens and removed the Drift app from AppExchange. By early September, operations were restored, but companies were left to untangle exactly what had been accessed and what needed to be remediated.

The attack campaign, attributed to threat group UNC6395, didn’t exploit Salesforce directly, it exploited trust. By impersonating a legitimate connected app, the attackers bypassed typical defenses and looked like normal integrations doing business as usual.

Why This Breach Matters in 2025

The Drift/Salesloft breach highlights three pressing realities about third-party risk today:

  1. Supply Chains Are Prime Targets. Attackers are increasingly focused on SaaS vendors, integrations, and managed services. Compromising one of these providers creates a multiplier effect across hundreds of downstream customers.
  2. OAuth Tokens Are the New Keys to the Kingdom. Traditional credentials may be locked down, but integrations rely heavily on long-lived tokens. When stolen, they offer near-invisible access until revoked.
  3. Support Data Is a Treasure Trove. The attackers zeroed in on support case text knowing it often contains secrets such as API keys, cloud credentials, and sensitive troubleshooting details. In 2025, it’s clear that attackers are not just after PII, but also the operational data that unlocks further compromise.

This isn’t just about one vendor’s failure, but represents the systemic challenge. Every organization is now part of an interconnected SaaS mesh, where trust can be abused at scale.

The Ripple Effect: Business and Security Consequences

Hundreds of organizations were affected. Tech and security firms including Cloudflare, Zscaler, and Palo Alto Networks reported that case data and contact details were exposed. While most confirmed no compromise of core infrastructure, the incident triggered widespread credential rotations, security audits, and customer communications.

The reputational impact was also significant. Even companies not directly affected faced scrutiny: customers, boards, and regulators asked the inevitable question, “Could this happen to us?”

How Companies Should Respond When a Breach Strikes

When a major third-party breach occurs, speed and focus are critical. Here are the steps every organization should adopt, drawing from lessons from Drift/Salesloft:

  1. Identify Exposure Quickly. Map where the breached third party and its integrations sit in your environment. Don’t stop at direct usage. Also look for indirect connections through your third-party ecosystem.
  2. Prioritize Vendors by Criticality. Focus resources on the integrations that touch sensitive data and core operations. Not every third party carries equal risk if they’re compromised.
  3. Launch Targeted Assessments. Avoid blanket questionnaires. Instead, send concise incident-specific assessments asking whether the breach impacted them, what controls they enacted, and how they are remediating. Utilize automated and AI TPRM tools to facilitate the assessment and response validation process to shorten this step and quickly remediate risk.
  4. Reassess Permissions and Integrations. Disable or reset Drift/Salesloft connections, rotate credentials, and scour logs for unusual activity. Pay special attention to service accounts and Connected Apps.
  5. Monitor for New Threat Signals. Breaches often inspire copycats. Strengthen continuous monitoring of your network and third-party ecosystem for cyber rating changes, new CVEs, and negative media mentions.
  6. Track Issues Through Resolution. Third-party assurances aren’t enough. Require evidence of remediation, log all issues, verify with AI tools and third-party security evaluators, and set deadlines for closure.
  7. Communicate Transparently. Provide executives, regulators, and customers with clear updates on impact, actions taken, and current risk status. This protects trust and demonstrates diligence. Consider creating a trust center as a source for your audience to stay updated on your security practices.
  8. Use Each Breach as a Stress Test. Ask hard questions: Did we find exposure fast enough? Were workflows smooth or sluggish? Every event is a chance to strengthen processes before the next one.

How ProcessUnity Helps During Threat Response

When breaches such as Drift/Salesloft occur, the key is to orchestrate, not scramble.

With ProcessUnity’s Third-Party Risk Management (TPRM) platform and our Threat & Vulnerability Response technology, organizations can move quickly to identify vulnerability exposure, prioritize the vendors and integrations that matter most, and launch targeted assessments. Remediation is tracked through to resolution with full auditability, while executive-ready reporting keeps stakeholders informed and confident.

Our AI TPRM technology combined with automated workflows turn a potentially chaotic event into a structured, strategic response.

Moving Forward: Building Resilience in a SaaS-First World

The Drift/Salesloft breach won’t be the last supply-chain incident of 2025 or the years beyond. Attackers are innovating, targeting the trust relationships at the heart of SaaS ecosystems.

For companies, the path forward means building true resilience in a SaaS-first world. This requires organizations to view vendor risk management as an ongoing, dynamic process rather than a one-time checklist. Consistently strengthening integrations, rigorously controlling credentials, and prioritizing investment in monitoring tools are a good place to start. It’s important for risk teams to establish efficient workflows that support fast, repeatable actions in the face of future breaches.

Ultimately, resilience comes from preparation. By strengthening third-party risk management now, organizations can turn future breaches from chaos into controlled, strategic response.

See how ProcessUnity’s TPRM Workflow platform and Threat and Vulnerability Response technology facilitate third-party risk mitigation and response in the face of emerging threats. Contact us today.

Related Articles

About Us

ProcessUnity is a leading provider of cloud-based applications for risk and compliance management. The company’s software as a service (SaaS) platform gives organizations the control to assess, measure, and mitigate risk and to ensure the optimal performance of key business processes. ProcessUnity’s flagship solution, ProcessUnity Vendor Risk Management, protects companies and their brands by reducing risks from third-party vendors and suppliers. ProcessUnity helps customers effectively and efficiently assess and monitor both new and existing vendors – from initial due diligence and onboarding through termination. Headquartered outside of Boston, Massachusetts, ProcessUnity is used by the world’s leading financial service firms and commercial enterprises. For more information, visit www.processunity.com.