Palo Alto Networks Confirms Data Breach via Compromised Salesforce Instances

Palo Alto Networks disclosed that its Salesforce environment was breached via a compromised Salesloft Drift integration, in what is described as a supply-chain-type intrusion affecting customer relationship management platforms. According to Palo Alto Networks, Salesloft’s Drift application suffered an intrusion that exposed OAuth credentials between 8 August and 18 August 2025, which threat actors used to extract data from connected Salesforce instances before tokens were revoked.

Investigators determined the compromise was isolated to the CRM platform, with no Palo Alto Networks products or services impacted. The breached data mainly comprised business contact information, internal sales account details, and basic case records, and only a limited number of customers may have had more sensitive data exposed; those clients are being notified directly.

Salesloft confirmed that all impacted customers have been informed and that active access and refresh tokens for the Drift application were revoked, forcing affected administrators to re-authenticate. Palo Alto Networks urges other organisations using the Drift integration to stay vigilant and follow recommended immediate response actions.