Anatomy of the Salesloft Breach - Detection, Response, and Lessons Learned

**Executive Summary:** The SalesLoft Drift supply‑chain breach involved a GitHub compromise that led attackers to harvest secrets from AWS, steal hundreds of per‑user OAuth tokens, and use those tokens to mass‑export Salesforce and other integrated service data—then mine those exports for additional cloud credentials; the report provides timelines, two observed attacker IPs, detection signals (bulk API usage, OAuth refresh patterns, premature export deletions), and remediation guidance.