Security Firms Hit by Salesforce–Salesloft Drift Breach

Hackers accessed customer contact information and case data from Salesforce instances at Cloudflare, Palo Alto Networks, and Zscaler as part of the Salesforce–Salesloft Drift data theft campaign. Between August 8 and August 18, they used compromised OAuth tokens for the third‑party Salesloft Drift bot to export data from hundreds of organisations’ Salesforce environments, with the attack disclosed on August 26.

The campaign has been attributed to a threat actor tracked as UNC6395 by Google and GRUB1 by Cloudflare, and aimed to harvest credentials and other sensitive information such as AWS access keys, passwords and Snowflake tokens. Cloudflare confirmed it exfiltrated customer contact information and basic support case data, including tokens later rotated as a precaution, while Zscaler noted stolen data included names, business emails, phone numbers, job titles and plain text content from certain support cases.

Palo Alto Networks stated it was among hundreds of customers impacted and that the attacker primarily exposed business contact data and related records before the incident was contained, with the company notifying affected customers. according to SecurityWeek.