Google warns of ‘widespread data theft’ targeting Salesforce customers

Google’s Threat Intelligence Group (GTIG) has linked a newly identified hacking group to a data breach campaign that exposed sensitive Salesforce customer information earlier this month.

The actor, tracked as UNC6395, is believed to have exploited OAuth tokens issued through Salesloft Drift integrations to gain access to Salesforce environments. Salesloft is a revenue orchestration platform that integrates with Salesforce. According to Google, the campaign began on 8th August and continued until at least 18th August 2025.

https://www.computing.co.uk/news/2025/security/google-warns-of-widespread-data-theft-targeting-salesforce-customers