Zscaler data breach exposes customer info after Salesloft Drift compromise

Zscaler has warned of a data breach after threat actors gained access to its Salesforce instance following the Salesloft Drift supply-chain compromise, exposing customer information stored there. According to Zscaler’s advisory, unauthorized actors obtained Salesloft Drift credentials for its customers, including Zscaler, and this granted limited access to some Salesforce data.

The exposed information includes names, business email addresses, job titles, phone numbers, regional details, Zscaler product licensing and commercial information, and content from certain support cases. The security firm says the breach affected only its Salesforce instance and did not impact Zscaler products, services, or infrastructure, and it has revoked all Salesloft Drift integrations to Salesforce and rotated API tokens.

Google Threat Intelligence has attributed the activity to a threat actor tracked as UNC6395, which has been linked to data theft from Salesforce instances via Salesloft Drift, with reports noting attempts to harvest credentials and tokens. Some researchers believe the Drift compromise also overlapped with other Salesforce-related data theft campaigns, and Google has warned of related activity affecting Google Workspace accounts as well.