Palo Alto Networks disclose a data breach linked to Salesloft Drift incident

Palo Alto Networks has disclosed a data breach linked to the Salesloft Drift supply-chain incident, which allowed attackers to access its Salesforce account, according to BleepingComputer. The exposed information includes Salesforce data such as Account, Contact, Case and Opportunity records, after attackers used stolen OAuth tokens from Salesloft Drift and mass-exfiltrated data while scanning for credentials.

Unit42 researchers note that the threat actor deleted queries to hide evidence of the jobs they run, a tactic described as an anti-forensics technique. Palo Alto Networks says all impacted customers have been notified and that it rotated credentials exposed in the exfiltrated data, including Salesforce API keys and connected app credentials.

The wider campaign has affected other entities, with Zscaler and Google also cited as victims of this drift-related activity, and Google warns that OAuth tokens used across Drift integrations could be compromised, urging credential rotation and re-authentication where needed.