Google warns that mass data theft hitting Salesloft AI agent has grown bigger

Google has issued a critical alert to users of the Salesloft Drift AI chat agent, advising them to consider all security tokens associated with the platform as compromised. This warning follows the revelation that unidentified attackers gained access to emails from Google Workspace accounts using some of these credentials. In response to the incident, Google has taken decisive action by revoking the tokens implicated in the breaches and has disabled integration between the Salesloft Drift agent and all Workspace accounts while further investigations are conducted. Affected account holders have been notified about the security compromise. Initially reported earlier this week, the breach was thought to be limited to Salesloft Drift integrations with Salesforce. However, Google’s Threat Intelligence Group (GTIG) has since updated its assessment, indicating that the scope of the breach is much wider than previously believed. The latest advisory highlights that the compromise extends beyond Salesforce integrations, affecting other connections as well. The advisory stated, "Based on new information identified by GTIG, the scope of this compromise is not exclusive to the Salesforce integration with Salesloft Drift and impacts other integrations." Consequently, Google now recommends that all Salesloft Drift users treat any authentication tokens stored in or linked to the Drift platform as potentially compromised. Meanwhile, Salesloft's security guidance page has not yet reflected the updated information, continuing to suggest that the breach is confined to Drift integrations with Salesforce. As of now, company representatives have not responded to requests for confirmation regarding Google's findings.