Zscaler Discloses Data Breach Following Salesforce Instance Compromise

Zscaler disclosed a data breach following compromise of a Salesforce instance, information revealed on 2 September 2025. Cybercriminals gained access to the Salesforce database through compromised third‑party application credentials, affecting customer contact information.

The breach originated from a broader campaign targeting Salesloft Drift, a marketing automation platform that integrates with Salesforce databases, with attackers stealing OAuth tokens from Salesloft Drift to access connected Salesforce instances across multiple organisations, including Zscaler. According to Zscaler’s investigation, the incident was confined to the Salesforce environment and did not impact Zscaler’s core products, services, or underlying infrastructure.

The exposed data included customer names, business email addresses, job titles, phone numbers, regional location details, and Zscaler product licensing information, with plain text content from some customer support cases accessed but attachments and images remaining secure; no evidence of data misuse was found so far, though the breach could be used for phishing or social engineering.

Zscaler revoked Salesloft Drift’s access to its Salesforce environment, rotated API tokens, and, with Salesforce, launched a broader third‑party risk management review and strengthened customer authentication for support interactions.