Palo Alto Networks data breach exposes customer info, support cases

Palo Alto Networks disclosed that it suffered a data breach exposing customer information and support cases after attackers abused compromised OAuth tokens from the Salesloft Drift breach to access its Salesforce CRM. The company said it was one of hundreds of organisations affected by the supply-chain attack disclosed last week, in which stolen authentication tokens were used to exfiltrate data.

The breach was limited to Salesforce and did not affect any Palo Alto Networks products, systems, or services, the firm added. The attacker exfiltrated mainly business contact and related account information, internal sales account records, and basic case data, with Palo Alto Networks noting that the exfiltrated support data did not include technical support files or attachments.

To contain the incident, tokens were revoked and credentials rotated, and customers were urged to treat the situation with immediate urgency by reviewing logs, examining Drift integrations, and rotating keys and secrets; automated tools like Trufflehog and Gitleaks were recommended for scanning code repositories. 2 September 2025.