Zscaler latest victim of Salesloft Drift attacks, customer data exposed

Zscaler is the latest company to disclose some of its customers' data was exposed in the recent spate of Salesloft Drift attacks affecting Salesforce databases. "Following a detailed review as part of our ongoing investigation, we have determined that these credentials have allowed limited access to some Zscaler Salesforce information," the cloud security shop's VP and Chief Information Security Officer Sam Curry said in an August 30 blog. The stolen information includes Salesforce-related content including names, business email addresses, job titles, phone numbers, regional/location details, Zscaler product licensing and commercial information, and plain text content from certain support cases — although Zscaler noted "this does NOT include attachments, files, and images." The security snafu occurred between August 8 and August 18, during which time a group suspected to be ShinyHunters (UNC6395) stole OAuth tokens from Salesloft Drift's integration with Salesforce. Drift, a third-party application used to automate sales processes, integrates with Salesforce databases to help manage leads and coordinate pitches, and compromising these OAuth security tokens allowed the data thieves to silently steal a ton of Salesforce customer data. "Our observations indicate that the threat actor performed mass exfiltration of sensitive data from various Salesforce objects, including Account, Contact, Case, and Opportunity records," Palo Alto Networks' Unit 42 incident responders warned toda...