Salesloft Drift: how a chatbot integration opened access to hundreds of companies’ data

In August 2025, attackers used keys stolen from Drift, an AI chat assistant connected to Salesforce, to export data from many companies. A reminder that every integration is also a door.

Drift is an AI chat assistant that companies put on their websites to answer visitors and capture leads. To work, it connects to other tools, such as Salesforce, the customer database. In August 2025, those connections were turned against its customers.

What happened

• Between 8 and at least 18 August 2025, a group tracked as UNC6395 by Google used stolen access tokens from the Drift–Salesforce integration.
• With them, the attackers exported data from many companies’ Salesforce accounts: contacts, accounts, support cases, opportunities.
• They searched that data for secrets, such as cloud access keys and passwords, left in support tickets.
• Salesloft and Salesforce revoked all of Drift’s tokens, and Google advised treating every Drift token as compromised.

Why it matters

An integration needs permanent access to work, through a token that acts like a key. If that key is stolen, the attacker does not need any password: the system sees a trusted application.

Lessons for any business using a chatbot or connected tools

• List every app connected to your customer database, email or website, and remove those you no longer use.
• Give each integration only the permissions it needs, for example read-only when possible.
• Never put passwords or access keys in support tickets or chat conversations.
• After an incident at a supplier, revoke and recreate the keys, without waiting.

AI does not remove the basics

A chat assistant can bring real value. But it is also software connected to your data, and it deserves the same care as any other access.

Every integration you add is a new key to your house: know who holds it.

Sources: Google Threat Intelligence as reported by Dark Reading, Arctic Wolf, TechRadar, August–September 2025.

Want an AI assistant on your website, connected safely? Tell us about your project through our estimate form: we will reply with an estimate and the next steps.