{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T20:45:43.249Z",
  "tag": {
    "id": "salesforce",
    "label": "Salesforce",
    "isStack": false,
    "url": "https://pwn.watch/t/salesforce",
    "feed": "https://pwn.watch/t/salesforce/feed.xml"
  },
  "counts": {
    "incidents": 2,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 2
  },
  "incidents": [
    {
      "slug": "salesloft-drift-oauth-salesforce-data-theft-2025",
      "title": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)",
      "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025",
      "json": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Salesloft Drift integration (Salesforce, Google Workspace)",
      "tags": [
        "salesloft",
        "drift",
        "salesforce",
        "oauth",
        "cloudflare",
        "data-breach",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Organizations with Drift connected to Salesforce or other apps"
      ],
      "fixedVersions": [
        "Drift tokens revoked; rotate any secrets stored in Salesforce"
      ],
      "startedAt": "2025-08-08",
      "closedAt": "2025-09-07",
      "updatedAt": "2025-09-07",
      "summary": "Between August 8 and 18, 2025, UNC6395 used stolen OAuth tokens for the Salesloft Drift chatbot integration to bulk-export data from customers' Salesforce instances, hunting for AWS keys, Snowflake tokens, passwords and VPN credentials. Cloudflare, Palo Alto Networks, Zscaler and many others disclosed exposure. Salesforce pulled Drift from AppExchange.",
      "xPost": null
    },
    {
      "slug": "salesforce-vishing-data-theft-unc6040-2025",
      "title": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)",
      "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025",
      "json": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "no-fix-needed",
      "product": "Salesforce customer instances (social engineering, not a Salesforce vulnerability)",
      "tags": [
        "salesforce",
        "google",
        "shinyhunters",
        "vishing",
        "data-breach",
        "extortion"
      ],
      "cveIds": [],
      "affectedVersions": [
        "n/a"
      ],
      "fixedVersions": [],
      "startedAt": "2025-06-04",
      "closedAt": "2025-08-31",
      "updatedAt": "2025-08-31",
      "summary": "UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).",
      "xPost": null
    }
  ],
  "posts": [],
  "changes": [
    {
      "incident": "salesloft-drift-oauth-salesforce-data-theft-2025",
      "incidentTitle": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-09-02",
      "title": "Cloudflare details the impact on its Salesforce case data",
      "body": null,
      "sourceUrl": "https://blog.cloudflare.com/response-to-salesloft-drift-incident/",
      "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025"
    },
    {
      "incident": "salesloft-drift-oauth-salesforce-data-theft-2025",
      "incidentTitle": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-08-26",
      "title": "Google Threat Intelligence publishes UNC6395 findings",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift",
      "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025"
    },
    {
      "incident": "salesloft-drift-oauth-salesforce-data-theft-2025",
      "incidentTitle": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-08-20",
      "title": "Salesloft and Salesforce revoke Drift access and refresh tokens; Drift pulled from AppExchange",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift",
      "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025"
    },
    {
      "incident": "salesloft-drift-oauth-salesforce-data-theft-2025",
      "incidentTitle": "Salesloft Drift OAuth tokens used to raid 700+ companies' Salesforce data (UNC6395)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-08-08",
      "title": "Data theft from Salesforce instances begins (through Aug 18)",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/data-theft-salesforce-instances-via-salesloft-drift",
      "url": "https://pwn.watch/i/salesloft-drift-oauth-salesforce-data-theft-2025"
    },
    {
      "incident": "salesforce-vishing-data-theft-unc6040-2025",
      "incidentTitle": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-08",
      "title": "Google confirms the breach exposed prospective Google Ads customers' contact info",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/google-confirms-data-breach-exposed-potential-google-ads-customers-info/",
      "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025"
    },
    {
      "incident": "salesforce-vishing-data-theft-unc6040-2025",
      "incidentTitle": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-06-04",
      "title": "Google Threat Intelligence describes UNC6040's vishing and Data Loader abuse",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion",
      "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025"
    },
    {
      "incident": "salesforce-vishing-data-theft-unc6040-2025",
      "incidentTitle": "Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2025-06",
      "title": "Google's corporate Salesforce instance breached by UNC6040",
      "body": null,
      "sourceUrl": "https://www.bleepingcomputer.com/news/security/google-suffers-data-breach-in-ongoing-salesforce-data-theft-attacks/",
      "url": "https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025"
    }
  ]
}