Stolen integration tokens opened a path to customer data

What was reported

Google Threat Intelligence Group reported that attackers used compromised Salesloft Drift OAuth tokens to access Salesforce customer instances in August 2025. They exported data and searched it for credentials. An August 28 update also described access to a small number of Google Workspace accounts specifically connected to Drift Email. Google said this was not a compromise of Google Workspace itself.

Read the original report from Google Threat Intelligence Group

Our perspective

Our reading: an integration creates a continuing access relationship, not just a single exchange of information. Teams need visibility into its scope and a way to end future access. This connects to Vivendur’s work on tool-specific permissions and the limits of revocation.