What happened
Google's Threat Intelligence Group reported that from at least Aug. 8 to 18, 2025, an actor it tracks as UNC6395 used stolen OAuth tokens for Salesloft Drift, an AI chat app connected to Salesforce, to export large volumes of data from many companies' Salesforce instances. The attackers then searched the data for secrets such as AWS keys, passwords and Snowflake tokens. Salesloft and Salesforce revoked all Drift tokens on Aug. 20, and Google later said all tokens connected to Drift should be treated as compromised. (Google Threat Intelligence Group (Google Cloud blog), Aug. 26, 2025)
What it means for Canada
This is the breach behind a Canadian one: ShinyHunters told BleepingComputer it got into TELUS Digital using Google Cloud credentials found in Drift-stolen data (the attackers' claim). Any Canadian company that connected Drift, or keeps secrets in CRM records and support tickets, faces the same pattern.
- Sectors
- Any company using Salesforce with third-party apps · Sales and marketing teams · Customer support
- Tools involved
- Salesforce · Salesloft Drift · Google Workspace (Drift Email) · AWS and Snowflake keys
- Canadian rules
- PIPEDA: report breaches with a real risk of significant harm to the OPC, notify affected people, keep a record of every breach
Quebec Law 25: report confidentiality incidents with a risk of serious injury to the Commission d'accès à l'information (CAI)
Takeaways for Canadian businesses
- BusinessIn Salesforce, go to Setup > Connected Apps > OAuth Usage and revoke or rotate tokens for every connected app, as Salesforce advises.
- BusinessTreat any credential ever stored in or connected to Drift as compromised and rotate it.
- BusinessSearch CRM records and support tickets for pasted secrets (AWS keys beginning AKIA, passwords, Snowflake tokens) and rotate any you find.
- BusinessReview Salesforce logs for unusual bulk queries by connected apps, starting with Aug. 8 to 18, 2025.
- BusinessIf customer data was exported, assess whether it creates a real risk of significant harm and report to the OPC (and the CAI in Quebec) if so.
For the Canadian AI sector
AI chat and agent integrations hold long-lived tokens into core systems. Canadian AI vendors that connect to CRMs will be asked how those tokens are scoped, stored and rotated.
Written by AgentsNorth from the source below. General information, not legal or security advice.