Zscaler data breach exposes customer info after Salesloft Drift compromise

Cybersecurity company Zscaler warns it suffered a data breach after threat actors gained access to its Salesforce instance and stole customer information, including the contents of support cases. This warning follows the compromise of Salesloft Drift, an AI chat agent that integrates with Salesforce, in which attackers stole OAuth and refresh tokens, enabling them to gain access to customer Salesforce environments and exfiltrate sensitive data. In an advisory, Zscaler says that its Salesforce instance was impacted by this supply-chain attack, exposing customers' information. "As part of this campaign, unauthorized actors gained access to Salesloft Drift credentials of its customers including Zscaler," reads Zscaler's advisory. "Following a detailed review as part of our ongoing investigation, we have determined that these credentials have allowed limited access to some Zscaler's Salesforce information." After publishing this story, Zscaler told BleepingComputer that data exfiltration occurred between August 13 to 16th, with the data accessed a few other times prior to then. The exposed information includes the following: The breach impacts a large number of customers but Zscaler is not sharing the total number. The company stresses that the data breach only impacts its Salesforce instance and no Zscaler products, services, or infrastructure. While Zscaler states that it has detected no misuse of this information, it recommends that customers remain vigilant against potential...