2025 Salesforce/Salesloft supply chain — business contact data exposed

Workday discovered that Salesloft's Drift application (connected to Salesforce) had been compromised. Attackers breached Salesloft, obtained OAuth credentials, and used them to access Workday's Salesforce environment. Exposed data: business contact information, support case details, tenant names, data center names, product/service names, training records, event logs. Workday stated no customer tenants or HR files were accessed. With 11,000+ corporate customers and ~70–75M users, the breach poses social engineering and scam risks. Part of broader OAuth vishing campaign targeting Salesforce customers.