Salesforce
Security incidents tagged Salesforce. Newest first.
0 Salesforce incidents in the last 12 months
- Incidents
- 2
- Live
- 0
- Patched
- 2
- Days without an incident
- 440
- Longest quiet run: 415 days (Sep 3–Oct 22)
Show 2 older incidents2 older incidents
August 2025 1
- HighNo fix needed
Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)
Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.
Salesloft Drift integration (Salesforce, Google Workspace)Closed Sep 7, 2025
June 2025 1
HighVishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)No fix needed
Salesforce customer instances (social engineering, not a Salesforce vulnerability) No fix needed
UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).
