The platform is trusted.
Who else has access?

The integration incident was not an exploitation of a Salesforce core vulnerability. That distinction matters when deciding what to fix: updating a platform does not, by itself, remove an application’s permissions or invalidate a stolen token.

It does not mean the customer has nothing to investigate. Review who approved the connection, what it could read, how long it retained access and whether its activity was observable. A small integration can carry a wide permission boundary.

Extortion claims also circulated in October 2025. Criminal claims about victim totals or stolen records should be treated as claims until independently established. Your organisation’s exposure needs evidence from its own environment and relevant supplier notices, rather than a headline count.

That second layer changes the investigation. A stolen contact list supports impersonation; a live cloud credential may support access to another service. Neither should be assumed from the fact of an export alone. Identify the actual fields, attachments and time range involved, then assess the consequences with the relevant data and system owners.

Keep any search for credentials controlled and authorised. The purpose is to identify exposed access and arrange revocation or replacement, not to copy sensitive values into a widely shared incident ticket. Preserve the evidence required for investigation while limiting who can see it.

Include other relevant connected services in the review. Google’s updated advisory warned that the Drift compromise was not limited to Salesforce integrations and described a small subset of Drift Email integrations involving Google Workspace. That is not evidence that every Workspace account was compromised.

For a live incident, agree who can make containment decisions and how the business will tolerate an interruption to an integration. Capture relevant logs and configuration evidence before it disappears where practical, without allowing evidence collection to become a reason to leave harmful access active.

Record both current and removed applications. A clean list today cannot prove that a connection was absent during the exposure period. Historical app consent, permission changes, API events and supplier communications may be needed to establish the boundary.

The 8–18 August window is specific to the activity described in Google’s report. It is a starting point for the historical Salesloft Drift investigation, not a universal time limit for every Salesforce-related campaign or a reason to stop investigating evidence outside it.

Begin with the logs actually available in your licence and retention arrangements. Export or preserve them using the organisation’s authorised process. A useful timeline distinguishes authentication, application authorisation, record access, export activity and response changes rather than treating every event as the same kind of evidence.

Google noted that deleting attacker-created query jobs did not remove the underlying event evidence available in the relevant logs. That supports preserving and examining the audit trail; it is not a promise that every customer retains every event indefinitely.

Where suspicious exports included personal information, assess the affected people, data and likely consequences with the privacy lead. Applicable notification duties depend on jurisdiction and circumstances. Keep the reasoning and timing of that assessment alongside the technical record.

A connected application needs a named business owner, a justified permission scope and a removal process. Review whether old integrations still serve a purpose, whether tokens are rotated or revoked appropriately and whether a supplier incident can reach someone authorised to act quickly.

Adopt a “no secrets in cases” rule supported by workable alternatives. Staff should know how to exchange sensitive information through an approved route; otherwise a prohibition can simply move the practice to email or an unmanaged document.

Exercise an integration compromise during a normal change period. Can the team identify the owner, obtain the evidence, revoke access, reach the supplier and verify that a restored connection is safe? The exercise should include commercial and service consequences as well as technical steps.

If an extortion demand arrives, use the agreed incident route and obtain specialist advice. Do not let an individual employee improvise negotiations from a compromised corporate mailbox. Preserve the demand, verify its claims and involve the appropriate law-enforcement and insurer contacts.