Salesloft to Temporarily Suspend Drift Following Widespread OAuth Token Theft
September 3, 2025
In a significant development within the cybersecurity landscape, Salesloft has announced plans to take its Drift service offline imminently. This decision follows a widespread supply chain attack that has affected numerous organizations, leading to the unauthorized acquisition of authentication tokens associated with the marketing software-as-a-service product.
Salesloft’s move comes as a proactive measure to facilitate a thorough review of the Drift application, with the aim of bolstering both its resiliency and security protocols before restoring full operations. The company has confirmed that the Drift chatbot service will be unavailable across customer websites during this maintenance period, effectively restricting access to the Drift platform.
Prioritizing the security and integrity of its systems and customer data, Salesloft has enlisted the expertise of cybersecurity firms Mandiant and Coalition to aid in its incident response efforts. Their collaboration will focus on uncovering the nature of the attack and addressing vulnerabilities that may have been exploited.
This breach is particularly concerning, as recent intelligence from the Google Threat Intelligence Group (GTIG) and Mandiant indicates that multiple entities have been affected. While specific organizations have not been publicly identified, the ramifications of this incident highlight the ongoing vulnerabilities within software supply chains used by tech companies, particularly in the U.S.
The attack’s methodology aligns with several tactics outlined in the MITRE ATT&CK framework. Initial access may have been gained through compromised authentication tokens, allowing adversaries to infiltrate systems undetected. Techniques related to privilege escalation may have facilitated further unauthorized actions within affected networks, amplifying the potential damage across multiple organizations.
Salesloft’s decision to pause Drift not only reflects awareness of immediate threats but also underscores the critical importance of maintaining stringent security measures in the face of evolving cyber threats. Business owners are reminded that such breaches can have far-reaching implications, not just for those directly targeted, but for the wider ecosystem of partners and customers as well.
As the investigation unfolds and systems are fortified, the cybersecurity community remains vigilant. The focus will undoubtedly be on ensuring that lessons are learned from this incident to prevent future occurrences, emphasizing the necessity for robust security frameworks and ongoing diligence in protecting sensitive data.