2026 OneDigital Investment Advisors — 28,414 individuals (Salesforce / Salesloft Drift; Aug 2025)
Data compromised
Names, Social Security numbers, and related CRM-held fields per regulatory notices
Technical writeup
OneDigital Investment Advisors LLC, an SEC-registered investment adviser based in Overland Park, Kansas, disclosed that unauthorized activity affecting Salesforce and the Salesloft Drift integration chain potentially exposed client data. The firm reported Salesforce’s August 22, 2025 notice of a possible event and forensic findings that an unauthorized actor may have accessed and copied certain OneDigital data in Salesforce between approximately August 12 and August 18, 2025, without compromise of OneDigital’s own internal network as described in public regulatory summaries. Maine and other state filings cited 28,414 affected U.S. individuals and categories including names and Social Security numbers, with discovery noted around December 22, 2025, and consumer notifications beginning April 8, 2026. This incident aligns with the broader Salesforce/Salesloft Drift OAuth supply-chain narrative (see salesloft-drift2025).
Root cause
Third-party Salesforce / Salesloft Drift integration compromise (OAuth token theft wave per industry context)