Security Update – Drift OAuth Incident Impacting Intellistack

At Intellistack, transparency and trust are at the core of everything we do — especially when it comes to safeguarding your data. We want to inform you about a recent third-party supply chain security event that may have affected a limited subset of customer data. This breach impacted many reputable organizations, including Intellistack.

What Happened?

We recently became aware of a broader campaign targeting Salesloft Drift, a third-party sales automation application integrated with Salesforce. This campaign involved the theft of OAuth tokens, which allowed unauthorized access to connected environments at multiple trusted companies, including Intellistack’s instance.

To be clear, this incident was not caused by a vulnerability or failure within Intellistack’s systems; rather, it was the result of compromised OAuth credentials within Drift. Intellistack’s platform remains secure.

Upon detection, we launched an immediate investigation and confirmed that a limited set of Intellistack Salesforce data was accessed using compromised Drift credentials. As part of our investigation, we estimate that approximately 1 in 5 customers may have had some data exposed as a result of this incident.

What Information May Be Affected?

The unauthorized access was restricted in scope and did not include sensitive credentials or full financial data. However, the data may have included:

• Public business contact details (e.g., name, job title, email, phone)
• Regional and location information
• CRM content such as Intellistack product licensing and commercial details
• Plain text headers from certain support cases

In rare cases, a limited number of customers may have had the last four digits of payment card or account numbers accessed. At this time, we have no evidence of misuse and are continuing to monitor the situation closely.

What Did Intellistack Do?

To reiterate, this incident resulted from a third-party breach within Drift’s systems, not Intellistack’s infrastructure. This was a supply chain attack that impacted a broad set of well-known organizations that rely on Drift integrations. However, the moment we identified the issue, we took swift and thorough action by revoking Drift’s access by uninstalling the integration. We also rotated all affected API tokens, and have since launched a full-scale internal investigation.

What You Can Do

While our investigation shows limited impact and no confirmed misuse, we advise customers to remain vigilant:

• Watch for unusual activity or phishing emails
• Verify that communications are coming from official Intellistack channels
• Report anything suspicious to: security@intellistack.com

Need Assistance or Have Questions?

If you have questions or concerns, please reach out to your Intellistack Customer Success contact or email our security team directly. Your trust is everything to us — and we remain committed to earning it every day.