Recovering from the Salesloft Breach

During the Salesloft breach attackers stole OAuth tokens from a Drift integration in Salesloft's GitHub repositories, giving access to customer Salesforce accounts and exposing data across hundreds of organizations; one enterprise had nearly 1,000 query datasets (over 4 million files) compromised. The report recounts how Cyera rapidly ingested, classified, and verified stolen data—finding sensitive credentials missed by other tools—and emphasizes speed, accuracy, and verification as key lessons for incident response.