Salesloft says Drift customer data thefts linked to March GitHub account hack

Salesloft disclosed that a March compromise of its GitHub account allowed attackers to exfiltrate repository content and steal OAuth/authentication tokens from its Drift and AWS environments; those tokens were then used to access customer Salesforce instances and steal sensitive data across multiple high-profile organizations, a supply-chain style data theft attributed by Google to UNC6395 and linked by other outlets to criminal groups such as ShinyHunters.