UNC6395 and the Drift OAuth Breach: A Supply Chain Failure with Consumer Consequences

The UNC6395 campaign, disclosed in late August 2025, is now recognized as one of the most widespread SaaS breaches of the year. By compromising OAuth tokens from Salesloft’s Drift integration, attackers infiltrated hundreds of Salesforce instances across industries. While many affected organizations were security vendors, the breach at TransUnion marks a turning point — shifting the narrative from internal CRM exposure to direct consumer harm.

TransUnion: The Consumer Flashpoint

TransUnion confirmed that attackers accessed its Salesforce environment via the Drift integration, exfiltrating sensitive data on approximately 4.4 million U.S. consumers. The stolen data includes:

• Full names

• Dates of birth

• Addresses and phone numbers

• Email addresses

• Unredacted Social Security Numbers

• Support ticket content and metadata

This breach is particularly significant given TransUnion’s role as a national credit bureau. Unlike vendor-side CRM leaks, this incident exposes individuals to identity theft, impersonation, and long-tail fraud risks. TransUnion has begun notifying affected individuals and regulators, and is offering credit monitoring and identity protection services.

Source: SecurityWeek coverage of TransUnion breach

Affected Vendors: The Broader Blast Radius

The following companies have publicly disclosed impact from the UNC6395 campaign:

1. TransUnion – Consumer data breach affecting 4.4M individuals

2. Cloudflare – Support case data and 104 API tokens exposed

3. Zscaler – CRM data including customer contact info and support case content

4. Palo Alto Networks – Internal sales records and basic case data accessed

5. SpyCloud – Salesforce data accessed via compromised Drift token

6. PagerDuty – Confirmed breach via Drift-Salesforce integration

7. Tanium – Limited exposure of Salesforce data; no platform compromise

8. Google – Small number of Workspace accounts accessed via Drift Email OAuth

9. Salesloft – Source of the compromised integration; Drift app taken offline

10. Drift – OAuth tokens exploited; integration removed from Salesforce AppExchange

Sources:

• CRN: 5 Cybersecurity Vendors Impacted

• Security Boulevard: Drift Breach Rolls Up Cloudflare, Palo Alto, Zscaler

• Obsidian Security: UNC6395 Overview

Strategic Takeaways

• OAuth Is a Supply Chain Risk Surface: Trusted integrations can become blind spots. Drift’s compromise bypassed traditional perimeter defenses and cascaded across Salesforce tenants.

• Token Hygiene Is Non-Negotiable: Organizations must treat OAuth tokens with the same rigor as credentials — enforce IP restrictions, rotate frequently, and audit scopes.

• Support Systems Are Attack Surfaces: Case data often contains sensitive credentials, logs, and configuration details. Vendors must sanitize inputs and enforce secure handling protocols.