HackerOne reports data breach through third-party Salesforce Drift Integration
Learn More
HackerOne, a vulnerability coordination and bug bounty platform, reports it was affected by a sophisticated supply chain attack that compromised its Salesforce environment through a third-party application.
The cause of the attack was a compromise of OAuth tokens associated with Salesloft's Drift application, which enabled unauthorized actors to access connected Salesforce instances across multiple organizations.
HackerOne was initially notified of the potential compromise by Salesforce on Friday, August 22, 2025, with confirmation from Salesloft following on August 23, 2025. Exposed data includes:
- General Salesforce contact records
- Standard account details and information
- Business correspondence and communications
- Administrative and operational data
The number of affected individuals is not disclosed.
HackerOne disabled the affected Drift integration and engaged external forensic experts to verify the complete extent of the breach and ensure no residual unauthorized access remained. The company claims that no customer vulnerability submissions, private security reports, exploit details, proof-of-concept code, or vulnerability assessments were exposed in the incident.
This incident represents part of a much larger supply chain attack that impacted over 700 organizations globally, according to Google Threat Intelligence Group assessments.
