Introduction

This article covers the advisory titled “Google Warns Salesloft Drift Breach Expands Beyond Salesforce to All Drift Integrations” and synthesizes the technical and operational details tied to drift, oauth, tokens, integration, salesforce, googleworkspace, threat-actor, unc6395, data-theft. The summary explains the incident background, timeline, impact, technical indicators, coordinated response, and practical lessons for cloud and identity teams.

Introduction

The TransUnion breach via a third party Salesforce app exposed personal data for approximately 4.4 million customers. This incident raises urgent questions about breach prevention, privacy safeguards, identity theft risk, monitoring, fraud prevention, vendor risk and supply chain exposure for financial data environments. The following article presents a full rewrite and detailed analysis while preserving all reported facts, timeline entries and remediation actions.