In early August, threat actors exploited stolen Drift Email OAuth tokens to access a limited number of Google Workspace mailboxes that had explicitly integrated with Drift. The same group had previously compromised Salesforce via similar OAuth token abuse. Google revoked the tokens and disabled the Drift integration on August 9, but the incident highlighted critical risks in third-party app delegations and token-based attacks. The breach did not involve direct hacking of Google’s systems but leveraged trusted OAuth integrations to bypass traditional security controls (MFA, identity hardening). While no large-scale data exfiltration was confirmed, the attack exposed vulnerabilities in SaaS app graphs, where legitimate API permissions become attack vectors. Customers responded by mapping Drift connections, rotating keys, and pruning access, but the incident underscored the need for content-level protections (e.g., message-level MFA) to mitigate token misuse. The attack aligns with a broader trend of token-theft campaigns (e.g., Snowflake, Salesforce), where actors exploit valid credentials to query high-value data at scale. Google’s rapid response limited dwell time, but the incident reinforced that perimeter defenses alone are insufficient against supply-chain risks in cloud workspaces.