Introduction

This article covers the advisory titled “Google Warns Salesloft Drift Breach Expands Beyond Salesforce to All Drift Integrations” and synthesizes the technical and operational details tied to drift, oauth, tokens, integration, salesforce, googleworkspace, threat-actor, unc6395, data-theft. The summary explains the incident background, timeline, impact, technical indicators, coordinated response, and practical lessons for cloud and identity teams.