Palo Alto Networks data breach exposes customer info, support tickets

Palo Alto Networks disclosed that a data breach exposed customer data and support cases after attackers abused compromised OAuth tokens from the Salesloft Drift breach to access its Salesforce instance, a widespread supply-chain attack the firm says affected hundreds of customers. According to Palo Alto Networks, the incident was limited to its Salesforce CRM and did not affect any of its products, systems, or services, and the company quickly contained the breach by disabling the Drift integration in Salesforce.

The attackers primarily exfiltrated business contact information, related account data, and basic case data, with ongoing notifications planned for impacted customers. Palo Alto Networks also noted that the exfiltrated support data contained only contact information and text comments, not technical files or attachments, and that the attackers used automated tools and deleted logs to obscure their actions.

The firm has revoked the associated tokens and rotated credentials, and urged Salesloft Drift customers to review logs, revoke credentials, and scan repositories for embedded keys or tokens. The update appears in a post dated 2 September 2025 at 08:00 BST.