SolarWinds issues advisory on Salesforce integration breach involving Salesloft Drift

IT management software provider SolarWinds has issued an advisory after a security incident involving the Salesloft Drift integration for Salesforce led to unauthorized access to customer data, though the company confirmed its own systems remain unaffected.

The breach stemmed from compromised OAuth tokens linked to Salesloft Drift, a widely used tool that connects sales and marketing functions with Salesforce. Threat actors exploited the tokens to infiltrate multiple Salesforce customer environments, allowing them to export large volumes of data. Investigators believe the attackers sought sensitive credentials, including access keys and passwords stored within the affected Salesforce instances.

Although SolarWinds uses Salesforce in its operations, it clarified that it does not employ the Salesloft Drift integration. As a result, its systems were not exposed to the attack. The company said it is treating the matter as a high priority, launching an internal review of its security protocols and committing to continuous monitoring for potential threats.

Security experts say the incident illustrates the risks of third-party software integrations, which can expand an organization’s attack surface. A single compromised application can create a pathway into a larger ecosystem, affecting multiple businesses that rely on the same tools. In this case, the abuse of OAuth tokens proved particularly concerning, as they can provide extensive permissions to access and move data across platforms.

The breach has renewed calls for organizations to apply stricter oversight of third-party applications. Industry best practices include limiting integration permissions to only what is necessary, conducting regular audits, and closely monitoring for unusual access behavior.

While SolarWinds was not directly impacted, the company stressed that the event serves as a reminder of the supply chain vulnerabilities present in cloud-based environments.