The Salesloft Drift breach expanded beyond initial estimates, revealing that attackers exploited stolen OAuth tokens not only to access Salesforce customer instances (including sensitive tables like Cases, Accounts, Users, and Opportunities) but also to compromise a small number of Google Workspace email accounts via the Drift Email integration. The threat actors, tracked as UNC6395, scanned support tickets and messages for AWS access keys, Snowflake tokens, and passwords, likely for future extortion or lateral movement into other cloud environments. Google confirmed the breach was broader than first disclosed, affecting third-party integrations beyond Salesforce. While no Google Workspace or Alphabet systems were directly compromised, the stolen tokens were revoked, and the Drift-Google Workspace integration was disabled pending investigation. Salesloft, with assistance from Mandiant and Coalition, disabled Drift integrations with Salesforce, Slack, and Pardot as a precaution. Customers were advised to rotate all authentication tokens linked to Drift and audit connected systems for unauthorized access. The incident highlights risks in OAuth-based supply chain attacks, where compromised third-party credentials enable deep access to enterprise systems, exposing customer data, internal communications, and cloud credentials to potential misuse in follow-on attacks.

OneDigital Data Breach Exposes Client Personal Information via Compromised Drift Application Between August 12 and August 18, 2025, a data breach at OneDigital Investment Advisors exposed sensitive client information after threat actors compromised the Drift application a tool managed by Salesloft and integrated with Salesforce, OneDigital’s customer relationship management (CRM) platform. The breach was discovered on August 22, 2025, when Salesforce notified OneDigital of the security incident. An investigation revealed that unauthorized parties accessed and copied data, including client names and Social Security numbers. While the breach stemmed from a third-party vulnerability, OneDigital confirmed its internal networks remained unaffected. Notifications to impacted individuals began on April 8, 2026, as OneDigital filed disclosures with regulatory authorities, including the Maine Attorney General’s Office. The incident has since drawn legal scrutiny, with attorneys exploring potential class action lawsuits on behalf of affected clients to seek compensation for privacy violations, financial losses, and other damages. OneDigital, which provides insurance, financial services, and HR consulting, has not disclosed the total number of individuals affected. The breach underscores the risks of third-party integrations in enterprise software ecosystems.

On June 8, 2022, OneDigital (Digital Insurance LLC) experienced a data breach caused by external system hacking. The incident was reported to the Maine Office of the Attorney General on August 1, 2022, confirming that 260 individuals were affected. Among the compromised data was the Social Security Number (SSN) of at least one Maine resident, indicating exposure of sensitive personal information. The breach involved unauthorized access to the company’s systems, leading to the potential leak of employee or customer data, though the full scope of the exposed information (beyond the confirmed SSN) was not detailed. Given the nature of the attack—external hacking targeting personal identifiers—it aligns with scenarios where financial or identity fraud risks arise. The company likely faced reputational damage and regulatory scrutiny, particularly due to the involvement of government-mandated disclosures and the sensitivity of SSNs in fraud schemes. While the breach did not explicitly state large-scale financial losses or operational disruptions, the compromise of SSNs elevates the severity, as such data is a prime target for identity theft and long-term fraud. The incident underscores vulnerabilities in third-party cybersecurity defenses, especially for firms handling highly regulated personal data like insurance providers.

The Maine Office of the Attorney General reported that Digital Insurance, LLC doing business as OneDigital experienced a data breach on January 20, 2021, due to external system hacking affecting 895 individuals, including 1 Maine resident. The compromised information included Social Security Numbers. Identity theft protection services were offered through Kroll for 12 months following the incident.