Salesloft: Hacker broke into systems in March through GitHub account

Salesloft disclosed that a threat actor compromised a Salesloft GitHub account from March through June, enabling downloads from repositories, addition of a guest user and malicious workflows; the attacker accessed Drift’s AWS environment and stole authentication/OAuth tokens tied to customer integrations, leading to data theft across dozens of major organizations (Google TIG reported ~700 related victims) including exposure of support-ticket contents and, in some cases, sensitive PII. Salesloft and impacted vendors isolated systems, rotated credentials, and are conducting forensic reviews.