Supply-chain attack hits Zscaler via Salesloft Drift, leaking customer info

According to Zscaler, a supply-chain attack tied to the Salesloft Drift campaign allowed unauthorized actors to access Drift credentials linked to Salesforce, exposing limited visibility into some of Zscaler’s Salesforce information.

The breach affected multiple Salesforce customers, with exposed data including names, business email addresses, job titles, phone numbers, regional details, and content from certain support cases, though Zscaler emphasised that its products, services and core infrastructure were not compromised.

Zscaler has revoked Drift’s Salesforce access, rotated API tokens, launched a joint investigation with Salesforce, added safeguards, reviewed third-party vendors and strengthened customer authentication to reduce phishing risks. The incident follows broader warnings that OAuth tokens tied to Salesloft Drift can impact various integrations, and that impacted customers should re-authenticate Salesforce connections and review token security.

The advisory notes that, after extensive investigation, there has been no evidence of misuse of the exposed information and urges customers to remain vigilant against phishing and social engineering. The article is dated 1 September 2025.