Incident: A stolen integration token exported CRM data

Module 7 · Incident file · About 35 minutes

What happened

On 27 August 2025 Google Threat Intelligence Group (GTIG) published "Widespread Data Theft Targets Salesforce Instances via Salesloft Drift", by Austin Larsen, Matt Lin, Tyler McLellan and Omar ElAhdan (Google Cloud blog). Salesloft Drift is a third-party application that customers connect to Salesforce. GTIG reported that "beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025", an actor it tracks as UNC6395 "targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft Drift third-party application".

This is not an MCP incident: no MCP server or host was involved. It is here because an MCP host that keeps tokens for many servers is the same kind of integration.

The actor "systematically exported large volumes of data from numerous corporate Salesforce instances", then searched it for secrets such as "Amazon Web Services (AWS) access keys (AKIA), passwords, and Snowflake-related access tokens". It deleted query jobs, but "logs were not impacted". On 20 August, Salesloft and Salesforce "revoked all active access and refresh tokens with the Drift application". An update on 28 August added that tokens for the "Drift Email" integration had been used on 9 August "to access email from a very small number of Google Workspace accounts", and advised customers to "treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised". GTIG states the issue "does not stem from a vulnerability within the core Salesforce platform". The post does not say how the tokens were stolen, and neither does this file.