Compromise of GitHub Account Triggers Salesloft Drift Breach Affecting 22 Companies
Sep 08, 2025
Supply Chain Attack / API Security
Salesloft has announced that the breach associated with its Drift application originated from a compromised GitHub account. An investigation by Google-owned Mandiant revealed that the threat actor, identified as UNC6395, accessed the Salesloft GitHub account over a span of three months, from March to June 2025. The method of access to the GitHub account remains unknown. Currently, 22 companies have reported being impacted by this supply chain breach. According to Salesloft’s advisory, the attackers leveraged this access to download content from various repositories, add a guest user, and establish workflows. The investigation also revealed that reconnaissance activities were taking place within the Salesloft and Drift application environments during the same time frame. However, it noted that there is no indication of any actions beyond these limited reconnaissance efforts. In the subsequent phase, the attackers gained access to Drift’s Amazon Web Services (AWS)…
Supply Chain Attack / API Security
GitHub Account Compromise Leads to Data Breach at Salesloft, Impacting 22 Companies In a development that underscores the vulnerabilities in software supply chains, Salesloft has disclosed that a significant data breach associated with its Drift application originated from the compromise of its GitHub account. This incident was investigated by Mandiant,…
Compromise of GitHub Account Triggers Salesloft Drift Breach Affecting 22 Companies
Sep 08, 2025
Supply Chain Attack / API Security
Salesloft has announced that the breach associated with its Drift application originated from a compromised GitHub account. An investigation by Google-owned Mandiant revealed that the threat actor, identified as UNC6395, accessed the Salesloft GitHub account over a span of three months, from March to June 2025. The method of access to the GitHub account remains unknown. Currently, 22 companies have reported being impacted by this supply chain breach. According to Salesloft’s advisory, the attackers leveraged this access to download content from various repositories, add a guest user, and establish workflows. The investigation also revealed that reconnaissance activities were taking place within the Salesloft and Drift application environments during the same time frame. However, it noted that there is no indication of any actions beyond these limited reconnaissance efforts. In the subsequent phase, the attackers gained access to Drift’s Amazon Web Services (AWS)…