From cybersecurity and big data to cloud computing, IT Brew covers the latest trends shaping business tech in our 4x weekly newsletter, virtual events with industry experts, and digital guides.

IT Brew

Google

Caroline Nihill

itbrew.com

An attacker targeted Salesforce in a widespread data theft through Salesloft Drift, a cloud-based and AI-powered sales engagement platform that allows sales teams to integrate with Salesforce instances. The theft is believed to have begun as early as Aug. 8 until at least Aug. 18.

 that it is engaging with cybersecurity leaders like Mandiant and Coalition to help the investigation, support containment, and assist with remediation. The company recommended that Drift customers revoke the existing API key for connections to third-party applications and reconnect using a new key.

The threat actor reportedly used OAuth credentials, which lets users give permission to an application to interact with another application on behalf of them without giving a password, to pull data from Salesforce customer instances that include cases, accounts, users and opportunities.

Allen Tsai, the senior director for corporate communications at Salesforce, told IT Brew in an email that all official statements from the company in relation to the incident can be found on a 

“Per our last update, Salesforce has disabled all integrations between Salesforce and Salesloft technologies including the Drift app; organizations will not be able to connect to Salesforce via any Salesloft apps until further notice,” Tsai said. “Please note this issue did not stem from a vulnerability within the core Salesforce platform.”

A report from the Google Threat Intelligence Group (GTIG) examining the data theft found that the threat actor exported large volumes of data from various Salesforce instances through a systematic approach.

“GTIG assesses the primary intent of the threat actor is to harvest credentials,” the report stated. “After the data was exfiltrated, the actor searched through the data to look for secrets that could be potentially used to compromise victim environments.”

 asserting that there is no evidence of ongoing malicious activity related to the incident, but saw in initial findings that the attacker was attempting to steal credentials such as Amazon Web Services access keys, passwords, and Snowflake-related access tokens.

, detected a security issue in the application on Aug. 20. The company reported that it “proactively revoked connections between Drift and Salesforce” and asked “Drift admins to re-authenticate their Salesforce connection.”

Drift customers that have not integrated with Salesforce are not impacted by this security issue, the company said. GTIG, however, said in an update on Aug. 28 that new information showed the scope of the compromise may not be isolated to the Salesforce integration with Salesloft Drift “and impacts other integrations.”

In addition to Salesloft Drift’s most recent recommendations for customers affected or potentially affected,

GTIG recommended that organizations that may have been impacted should look for sensitive information in Salesforce objects and take action to revoke API keys, rotate credentials, and further investigate to see if the threat actor abused any secrets.

“Organizations using Drift integrated with Salesforce should consider their Salesforce data compromised and are urged to take immediate remediation steps,” GTIG said.

The law office of Lowenstein Sandler put out a 

 on Aug. 27 to share that potentially impacted customers could contact their IT team to find out if their company has a Salesforce integration with Drift’s application.

“Given the prevalence of AI integrations, we expect to see more breaches regarding vendors using AI-based technologies,” the release states.

GTIG also reported that there has been no evidence to indicate any impact to Google Cloud customers, but advised Salesloft Drift customers to review Salesforce objects for Google Cloud Platform account keys.

 that offers combined services that address data and AI assistance.

 in late July that Gmail attacks increased by 84% for email-delivered infostealers in 2024, a trend that “has only intensified in 2025.”

 that attackers are accessing Gmail accounts, helped significantly by compromised passwords. The company warned that most Gmail users have to change passwords to secure their accounts, but told Forbes it had not been affected by the Salesforce breach.

Salesloft Drift did not respond to a request for comment at the time of publication.

An illustration of a gloved hand coming out of a laptop screen holding a key

Salesloft Drift data breach exposes Salesforce customer data

Drift customers that have not integrated with Salesforce are not impacted by this security issue. 

Google is continuing its push into the cloud service provider ecosystem with its latest contract with digital workflow management platform ServiceNow.

According to Bloomberg, citing an anonymous source familiar with the deal, ServiceNow will spend $1.2 billion over the next five years on Google’s cloud computing services.

The deal follows ServiceNow’s partnerships with other cloud providers, the company shared in a statement to Bloomberg, which was also provided to IT Brew. ServiceNow declined to reveal specific details of other contracts, including who they are with.

Google did not respond in time for a request to comment. ServiceNow declined to give IT Brew a statement with a named spokesperson.

 to Google’s recent partnerships with companies like Salesforce and OpenAI as evidence for its “growing influence” in the cloud market, despite the historical dominance of AWS and Microsoft.

 that Google would provide cloud computing services to help with OpenAI’s need for increased computing capacity. The deal, which was inked in May, would specifically add the capacity for OpenAI’s “existing infrastructure for training and running its AI models.”

In February, Google and Salesforce announced that they would add Google Gemini to Agentforce, according to a 

“Google Cloud is at the forefront of enterprise AI innovation with millions of developers building with Google’s cutting-edge Gemini models and on Google Cloud’s AI optimized infrastructure,” the release said.

The company said that the deal was an expansion of an “existing partnership” to let customers use data “bi-directionally” from Google BigQuery and Salesforce through 

 which allows professionals to access data from different locations at the same time without needing to move or reformat.

“Salesforce Service Cloud will become more tightly integrated with Google Customer Engagement Suite, bringing enhanced AI-enabled contact center capabilities including real-time voice translation, intelligent agent-to-agent handoffs, personalized agent recommendations, and AI-driven conversational insights across all channels,” the release said.

 to help fund AI initiatives. The new product packaging and pricing will push the company toward the edge of innovation and give its employees access to the technology and other agentic tools, according to a release.

Google signs $1.2 billion deal with ServiceNow

Google will reportedly provide five years of cloud computing services for ServiceNow, according to Bloomberg.

If US-based Googlers want to say goodbye to their “innies,” the company is offering buyouts to more teams.

Google spokesperson Courtenay Mencini told IT Brew that the company teams are offering the buyout program with severance for employees based in the US, “who many want to leave the company, whether for professional or personal reasons.”

“Earlier this year, some of our teams introduced a voluntary exit program with severance for US-based Googlers, and several more are now offering the program to support our important work ahead,” Mencini wrote.

The statement continued: “US-based employees on teams offering the voluntary program are able to apply regardless of role or level.”

Those on Google’s knowledge and information (K&I), central engineering, marketing, research and communication teams are able to part ways with the company. This follows earlier buyout announcements that affected Google’s 

Buyouts offered to the platforms and devices team were offered as a result of the large operating systems and hardware team’s merger last year, 

, and given as an option to employees that might not have been aligned with Google’s mission.

Mencini did not elaborate on the “work ahead” or respond directly to a question regarding what prompted these buyouts.

 reported that Google is offering a minimum of 14 weeks’ pay with an enrollment deadline of July 1 to employees in some orgs.

, mandating office returns to remote workers who live within 50 miles of an office to begin a hybrid work schedule and bring employees together in-person, which the company confirmed.

The outlet also shared a memo written by Google executive Nick Fox, who leads the K&I team, concerning the buyouts, which reads: “I really (really!) hope you don’t take this! We have ambitious plans and tons to get done…On the other hand, this [voluntary exit program] offers a supportive exit path for those of you who don’t feel aligned with our strategy, don’t feel energized by your work, or are having difficulty meeting the expectations of your role.”

Google announces expansion to company buyout for US employees

Google says the buyout program is now stretching to central engineering, knowledge and information, and research teams, among others. 

Billy Hurley

It’s almost like Hobbs and Shaw—two heavyweights putting rivalry aside and teaming up against a common enemy: computing power.

, OpenAI plans to add Alphabet’s Google Cloud service to its list of compute providers. The cloud support will assist OpenAI in training its AI models and meeting the massive computational demands for its jobs, sources told Reuters.

The move raised eyebrows from analysts, given the two companies’ competition.

“Ultimately, we view this as a big win for Google’s cloud unit, but...there are continued worries that ChatGPT is becoming an incrementally larger threat to Google’s search dominance,” Scotiabank examiners wrote in a Tuesday note.

 In addition to search, both companies compete as AI builders. Alphabet’s Google DeepMind lab has created models like Gemini 2.5, while OpenAI has introduced recent LLMs like OpenAI o3 and o4-mini.

 $10 billion in annual recurring revenue, less than three years after launching ChatGPT in November 2022. The popular tool (which recently 

 as of March, according to the company (along with three million 

The company’s CEO Sam Altman has been open(AI) about the company’s need for power. “I think compute is going to be the currency of the future,” he said on the 

 one year ago. “I think it’ll be the most precious commodity in the world.” (He also tweeted in March that the company’s GenAI tool was 

The Google and OpenAI partnership—finalized in May—adds to recent deals for OpenAI to gather computing capacity. The company signed a 

 with cloud startup CoreWeave in May, and announced 

 a $500 billion investment in the AI infrastructure-building Stargate project.

Alphabet has been enthusiastic about its Google Cloud usage and growth. In its most recent earnings call, the company highlighted its GPU offerings, including Nvidia’s B200 and GB200 Blackwell chips, and its custom-designed tensor processing units (

). The Google Cloud Next conference in April showcased many business uses, like the introduction of AI security-focused agents for Dunn and Bradstreet, Google shared on its blog, and on-premise Gemini models for Nvidia and Dell.

According to Alphabet’s Q1 earnings report, Google Cloud revenue increased by 28% year over year to $12.3 billion.

The OpenAI and Google deal surprised one Gartner analyst—only because it took so long.

“I anticipate that OpenAI and Google and other frontier model innovators will continue innovating and exploring frontiers of infrastructures and model capabilities. Today the needs overlap, hence the mutually beneficial partnership,” Chirag Dekate, VP analyst at Gartner, wrote in an email to IT Brew.

He warned, however, Google now has to balance TPU usage among its cloud clients and internal projects like DeepMind. An agreement with a growing AI giant like OpenAI complicates resource planning.

“GPU leaders must redouble their efforts to lower cost structures for clients,” Dekate wrote.

Neither OpenAI nor Google responded to June 10 requests for comment about specifics of the partnership and how the partnership will benefit their respective companies.

OpenAI and GoogleAI logos on podiums surrounded by binary code.

To meet massive compute demands, OpenAI calls on Google Cloud

The move surprised some (but not all) analysts.

Amanda Florian

Google Cloud accidentally deleted the account of one of its customers. In a 

 on May 8, Google Cloud and UniSuper—the Australian pension fund that experienced the disruption—said that Google Cloud has been “conducting a root cause analysis” of the “one-of-a-kind occurrence.”

“Google Cloud CEO Thomas Kurian has confirmed that the disruption arose from an unprecedented sequence of events whereby an inadvertent misconfiguration during provisioning of UniSuper’s Private Cloud services ultimately resulted in the deletion of UniSuper’s Private Cloud subscription,” the statement said.

 Australian (approx. $90 billion US) in pension funds—thankfully had another backup in place with a different provider, and that helped minimize “data loss” and “significantly improved the ability of UniSuper and Google Cloud to complete the restoration,” the joint statement also read.

“It’s almost unprecedented to think an organization of that size could just have their entire cloud account completely deleted,” Scott Leach, the vice president of the Asia-Pacific region at Varonis—a NYC-based company that specializes in software for data security, governance, threat analytics, and more—told IT Brew. “Your entire search—all of the applications that you’re running, all of the data that those applications store, all of the users that have access to that data into those applications—all of it gone.”

Leach commended Google and UniSuper for having a clear communication strategy in quickly relaying info and eliminating any doubt of a 

. He also said UniSuper’s decision to have a backup with another provider was an “impressive” step taken on their part.

“If they had not had that extra backup, who knows how much data might have been lost? Who knows how long the disruption might have been?” Leach said. “There’s definitely a lesson there for other organizations to make sure that you’ve got a kind of multi-cloud approach for your systems and for [your] backup, so that if one cloud provider fails—if this sort of thing happens—you’ve got somewhere else to turn to be able to get service restored, to get your data back.”

Members are now able to log in to their accounts as usual, and services have been fully restored as of May 15, a 

IT Brew has reached out to both Google and UniSuper for comment. UniSuper did not provide any new comments but directed IT Brew to 

 that contained a statement and FAQs about the incident.

Google Cloud accidentally deletes Australian customer’s account 

 “It’s almost unprecedented to think an organization of that size, could just have their entire cloud account completely deleted.” 

Like a warm Costco mini-pizza, people might not know that they want a passkey until it’s right in front of their faces.

During a May discussion led by authentication provider Okta, one panelist said login developers need to change their mindset and make passkeys more than another password alternative.

Passkeys should, in fact, be the standard, Vishnu Allaparthi, partner of cyber, risk, and regulatory practice at the pro-services firm PwC, told attendees on the call.

In the free-sampling spirit, Google announced that its Workspace and Cloud users have the choice to log in with passkeys. The move, an open Beta program that allows more than 9 million organizations to sign in to Google Workspace and Google Cloud accounts with the digital credentials, demonstrates a further poke at the password, as another big player provides the alternative login.

“While users can still continue using passwords to sign in to their work and personal Google Accounts, passkeys can offer a simpler and more secure alternative and can reduce the impact of phishing and other social engineering attacks,” said Jeroen Kemperman, product manager, Google Workspace and Shruti Kulkarni, engineering manager, Google Workspace in 

In early May, Google made passkeys available for personal accounts.

A passkey is a unique handshake between an end user and their destination. After a push notification is sent, the individual uses a biometric or PIN authenticator to create their public login key.

At subsequent logins, only the authenticator is required—no password. If the token is somehow compromised, the credential is only valid for the one login connection—unlike passwords, 

The passkey itself is stored on the individual’s local device or computer, which will ask for biometrics or PIN to confirm identity.

Aside from the security benefit of avoiding reused passwords, the option is a potentially fast one. In March and April of 2023, Google data demonstrated 

 for passkeys over passwords.  (And a sign-in speed of 14.9 seconds.)

In May 2022, Apple, Google, and Microsoft all announced a commitment to building passwordless sign-options to their platforms. Apple, for example, released its passkey implementation with iOS 16.

Google’s digital-credential options brings more momentum to passwordless passing the password, or at least existing alongside it:

“I do believe in the next three to five years, the vast majority of consumer services will offer password-free sign-in options,” said Andrew Shikiar, executive director and chief marketing officer at the global consortium and open-standard maker FIDO Alliance, during the Okta-led meeting in May.

“And, of course, our hope is that those will rely on things like passkeys,” Shikiar told attendees.

Google offers passkeys for Workspace and Cloud users

Another passkey feature, another poke at the password

 in May have some serious security .implications.

Tag library descriptor (TLD) files like .zip or .mov offer extra bait for phishers who can disguise malicious files with their newly bought domain name.

“The problem is that it sort of confuses what’s a local file and what’s a remote website. So, the distinction between remote and local gets kind of murky here, as far as the user is concerned,” said Johannes Ullrich, dean of research at 

Shortly after Google’s May 3 domain divulgence, SANS found a spike in new .zip domains, including just under 2,500 on May 14. (It’s unclear how many domain buyers have attacks in mind vs. penetration tests.)

Some recent purchases: chrome-installer.zip, amazon-receipt.zip, and adobephotoshop.zip.

With just these three domains, a phisher could pretend to have an Amazon invoice, which then sends the end-user to a lookalike site that nabs credentials. Or maybe a threat actor could impersonate an IT pro and entice employees to get a false browser update.

A threat actor could use a .zip domain—often automatically hyperlinked and easily clickable in platforms—to mask a malicious file or site. (See a clever 

In the early May announcement, Google launched top-level domain adds, including .dad and .foo, to broaden naming choices. (Not so for .mom, apparently.)

“There is no active, good use of these domains. So, you may as well just block .zip and .mov,” Ullrich told IT Brew.

Google’s security comms manager Kimberly Samra sent a company statement via email: “The risk of confusion between domain names and file names is not a new one. For example, 3M’s Command products use the domain name command.com, which is also an important program on MS DOS and early versions of Windows…Google takes phishing and malware seriously and Google Registry has existing mechanisms to suspend or remove malicious domains across all of our TLDs, including .zip. We will continue to monitor the usage of .zip and other TLDs and if new threats emerge will take appropriate action to protect users.”