Salesloft Drift. The access path.
Stolen OAuth tokens exported Salesforce data from hundreds of orgs. How compromised OAuth tokens turned a SaaS integration into a path to sensitive data.
The record
Entry point. drift-oauth-token, stolen; scoped to read/query Salesforce.
The identity in the middle. The Drift OAuth token held by each affected organisation, scoped to read and query Salesforce.
What was reached. Salesforce data exported from each affected org.
Stolen OAuth tokens exported Salesforce data from hundreds of orgs.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| drift-oauth-token | Entry | stolen; scoped to read/query Salesforce |
| salesforce-org | Step | access depends on each stolen token’s scope |
| SOQL bulk export | Reached | pull everything the token can see |
Where a breakpoint would have been
The scope on each token. The breach happened at the vendor, but what each organisation lost was decided locally, by how much the integration had been allowed to see.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page. The full narrative is in the teardown.
3 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Google GTIG · The Hacker News, Gainsight · The Hacker News, Klue / Icarus
Questions, answered.
The two questions this record answers.
What was the entry point in the Salesloft Drift incident?
The published path starts at drift-oauth-token, stolen; scoped to read/query Salesforce.
What did it reach?
The published path ends at Salesforce data exported from each affected org.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.