Salesforce

This is the most consequential single row in the tracker, because it is not one company's breach but the mechanism behind dozens of them. Attackers phoned employees pretending to be IT support, walked them to Salesforce's connected-app page and had them type a code that authorised a malicious app - and separately compromised the GitHub account of an integration vendor, Salesloft, to steal OAuth tokens that reached more than 700 downstream Salesforce customers at once. Total organisation and record counts have not been independently confirmed; the largest figures in circulation come from the attackers themselves. No zero-day and no malware were required at any point. The victims a consumer would recognise - Qantas, Adidas, Allianz Life, Google, Workday, Stellantis, Gucci, Grubhub - had no common vendor a customer could see, and none of them chose Salesloft. This is what concentrated SaaS infrastructure means in practice: the security boundary that determines your exposure is several companies removed from the one you gave your data to.

• Severity
• Evidence tierUnassigned
• Claims confirmed
• Last verified2026-08-04

Primary source. cloudsecurityalliance.org/blog/2025/09/25/the-salesloft-drift-oauth-supply-chain-attack-cross-industry-lessons-in-third-party-access-visibility — Verified - primary source confirmed.

Arbitration

Salesforce itself was hit with 14 lawsuits arising from this campaign by late September 2025 (per a Salesforce Ben roundup; whether they have since been consolidated was not verified); Salesforce's own legal position is that its CORE PLATFORM was never directly breached — the exposures resulted from customers' own security choices (phished employees, misconfigured guest-user permissions) rather than a Salesforce vulnerability — a technically defensible distinction that nonetheless doesn't change the real-world exposure customers experienced.

Contacts

Privacy contact. Not recorded.

Legal notice. Not verified this pass. If publicly traded: SEC Form 10-K cover page gives the official corporate address; the Secretary of State business-entity search in the state of incorporation gives the registered agent, which must accept service. If private: the state registered agent is usually the only reliable route.

Mailing address. Not recorded.