HackerOne Incident Update: Salesforce

HackerOne confirmed that a subset of its Salesforce records was accessed through a compromise of the Drift (Salesloft) application on August 13 and 18, 2025. They disabled Salesforce-Drift connectors, rotated API/service credentials, engaged a third-party forensics firm, and reported no evidence of lateral movement or exposure of customer vulnerability data; the incident was later remediated and closed on November 10, 2025.