Elastic and the Salesloft Drift breach (2025): one inbox exposed, products not affected
Elastic makes Elasticsearch and Elastic Security, a widely used SIEM. When the Salesloft Drift OAuth tokens were stolen in August 2025, Elastic investigated its own use of Drift and found one exposed email inbox. This page records exactly what Elastic said.
Short answer
Was Elastic hacked?
Yes, in a limited way, through a third party. On 4 September 2025 Elastic said that one email account connected through Salesloft’s “Drift Email” integration was exposed, which “may have granted an unauthorized actor read-only access to emails received in that inbox”. A small number of inbound emails in it contained potentially valid credentials.
Elastic said its investigation confirmed its Salesforce environment “was not impacted”. It said it notified the customers it identified as affected: “If you did not receive notice from us, we did not identify you as an affected customer.” Elastic has not reported any compromise of Elastic Cloud or its products.
Timeline at a glance
8–18 Aug 2025UNC6395 uses stolen Drift OAuth tokens against Salesforce and Drift Email integrations. (Google Threat Intelligence)Confirmed
26 Aug 2025Salesloft discloses the Drift incident; Elastic starts its own review. (Elastic)Confirmed
4 Sep 2025Elastic: one inbox exposed via Drift Email, some emails held valid credentials; Salesforce not affected. (Elastic)Confirmed
Last updated 1 November 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Elastic incident timeline, in detail
Confirmed = acknowledged by Elastic, a regulator filing or a court. Reported = credible reporting Elastic has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Aug – Sep 2025ConfirmedThird-party SaaS / OAuth token theft
One Elastic inbox exposed through the Drift Email integration
What happened. Elastic said it had not been notified of any impact by Drift but began incident response after Salesloft’s 26 August 2025 disclosure, disabled its Drift integrations and gathered logs. It found that one email account connected through the Drift Email integration was exposed, which may have given the actor read-only access to that inbox. Google’s Threat Intelligence Group separately said the actor used Drift Email tokens on 9 August 2025 to read email in a very small number of Google Workspace accounts integrated with Drift.
Impact. Elastic scanned the inbox and found a small number of inbound emails with potentially valid credentials, and notified the customers it identified. It said its Salesforce environment was not impacted. Elastic did not say whether any of the credentials were used.
Some lists of Drift victims imply Elastic’s Salesforce data was taken. Elastic says its Salesforce environment was not impacted; the exposure was one email inbox.
Elastic has not said whose credentials were in the emails or how many customers it notified.
The pattern across the record
Email integrations are data stores too
The exposure was not a database but an inbox that a sales tool could read. Anything customers emailed to that address, including credentials, came along with it.
What it means for Elastic customers — and what to do
If Elastic notified you, treat any credential you emailed to Elastic as exposed. If it did not, Elastic says you were not identified as affected.
1.Rotate credentials you have emailed to Elastic
Elastic Cloud API keys, ingest or Fleet enrollment tokens, and passwords sent to Elastic staff by email should be rotated. Verify the new value works before revoking the old one.
Yes, in a limited way. In the 2025 Salesloft Drift incident one Elastic email inbox connected to the Drift Email integration was exposed to possible read-only access. Elastic says its Salesforce environment was not impacted.
What did Elastic lose in the Drift breach?+
Possibly the contents of one inbox, which included a small number of emails with potentially valid credentials. Elastic notified the customers it identified as affected.
Was Elasticsearch or Elastic Cloud breached?+
Elastic has not reported any compromise of its products or Elastic Cloud in this incident.
Are exposed Elasticsearch databases an Elastic breach?+
No. Unsecured Elasticsearch servers found online are run by their owners; their exposure is a configuration failure by that owner, not a breach of Elastic.
What should Elastic customers do?+
If notified, rotate any credentials you emailed to Elastic. In any case, review vendor access to your deployments and stop sending secrets by email.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Elastic. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. Claim 3 months for $5 →