The post has been translated automatically. Original language: English
Every third-party integration a company connects is a point of access it doesn't fully control. Most of the time that's an acceptable trade — a tool solves a real problem, someone authorizes it, work moves faster. The risk only becomes visible on one specific day: when that integration is compromised badly enough that its credentials have to be treated as stolen, and the fix is to revoke them all at once. Everything running on that access simply stops. A company doesn't inherit a feature. It inherits a switch, and on the worst day, someone outside the company throws it.
What happened
In August 2025, Google's Threat Intelligence Group reported a campaign using compromised OAuth tokens from a third-party chat app, Salesloft Drift, to access corporate Salesforce instances over roughly ten days. The tokens were valid, so the access looked legitimate — this wasn't a Salesforce vulnerability. On August 20, all active tokens for the application were revoked, and the compromise later turned out not to be limited to that one integration.
The real disruption is the second blast
The breach makes headlines. The revocation is what actually disrupts operations: unable to isolate exactly whose tokens were taken, the vendor revoked the entire token store at once. Every sync, dashboard, and automation riding that access stopped, often with no warning — frequently showing up first as quietly stale data rather than an obvious error, which is worse, since a three-day-old dashboard still gets used in a meeting. A company doesn't have to be breached to feel this. It only has to be a customer of the same integration — the broader pattern worth sitting with: any access point you don't directly control is effectively someone else's switch on your own systems.
Why this hits revenue-facing teams first
- They run on the largest number of third-party integrations, because the work genuinely requires many systems to exchange data.
- Many connections get set up directly by the team that needs them, without a security review.
- Continuity planning usually covers transaction-critical systems, not the reporting stack — so there's a plan to restore order-taking systems, and no plan to restore the ones that tell leadership whether the quarter is on track.
Before the worst day
- Inventory what actually holds live credentials to your systems — including personal grants set up by someone who has since left or changed roles.
- Name one owner per integration who could say, within an hour, exactly what breaks if it's revoked.
- Write a revocation plan — not just a breach plan — for your handful of most-depended-on integrations.
- Ask vendors directly what happens if they have to revoke everything at once, and how fast a connection could be rebuilt. Vendors who've thought about it answer immediately.
None of this prevents a breach elsewhere in the supply chain. It just means the question afterward becomes which one connection to restore, not which of forty people to even ask — and it's worth asking now, before any particular vendor makes that question urgent.
Source: based on Google Threat Intelligence Group's public advisory on the August 2025 Salesloft Drift / Salesforce token compromise.
Every third-party integration a company connects is a point of access it doesn't fully control. Most of the time that's an acceptable trade — a tool solves a real problem, someone authorizes it, work moves faster. The risk only becomes visible on one specific day: when that integration is compromised badly enough that its credentials have to be treated as stolen, and the fix is to revoke them all at once. Everything running on that access simply stops. A company doesn't inherit a feature. It inherits a switch, and on the worst day, someone outside the company throws it.
What happened
In August 2025, Google's Threat Intelligence Group reported a campaign using compromised OAuth tokens from a third-party chat app, Salesloft Drift, to access corporate Salesforce instances over roughly ten days. The tokens were valid, so the access looked legitimate — this wasn't a Salesforce vulnerability. On August 20, all active tokens for the application were revoked, and the compromise later turned out not to be limited to that one integration.
The real disruption is the second blast
The breach makes headlines. The revocation is what actually disrupts operations: unable to isolate exactly whose tokens were taken, the vendor revoked the entire token store at once. Every sync, dashboard, and automation riding that access stopped, often with no warning — frequently showing up first as quietly stale data rather than an obvious error, which is worse, since a three-day-old dashboard still gets used in a meeting. A company doesn't have to be breached to feel this. It only has to be a customer of the same integration — the broader pattern worth sitting with: any access point you don't directly control is effectively someone else's switch on your own systems.
Why this hits revenue-facing teams first
- They run on the largest number of third-party integrations, because the work genuinely requires many systems to exchange data.
- Many connections get set up directly by the team that needs them, without a security review.
- Continuity planning usually covers transaction-critical systems, not the reporting stack — so there's a plan to restore order-taking systems, and no plan to restore the ones that tell leadership whether the quarter is on track.
Before the worst day
- Inventory what actually holds live credentials to your systems — including personal grants set up by someone who has since left or changed roles.
- Name one owner per integration who could say, within an hour, exactly what breaks if it's revoked.
- Write a revocation plan — not just a breach plan — for your handful of most-depended-on integrations.
- Ask vendors directly what happens if they have to revoke everything at once, and how fast a connection could be rebuilt. Vendors who've thought about it answer immediately.
None of this prevents a breach elsewhere in the supply chain. It just means the question afterward becomes which one connection to restore, not which of forty people to even ask — and it's worth asking now, before any particular vendor makes that question urgent.
Source: based on Google Threat Intelligence Group's public advisory on the August 2025 Salesloft Drift / Salesforce token compromise.
Share
