Cybersecurity firm Zscaler warns it suffered a knowledge breach after menace actors gained entry to its Salesforce occasion and stole buyer data, together with the contents of assist circumstances.
This warning follows the compromise of Salesloft Drift, an AI chat agent that integrates with Salesforce, during which attackers stole OAuth and refresh tokens, enabling them to realize entry to buyer Salesforce environments and exfiltrate delicate knowledge.
In an advisory, Zscaler says that its Salesforce occasion was impacted by this supply-chain assault, exposing clients’ data.
“As a part of this marketing campaign, unauthorized actors gained entry to Salesloft Drift credentials of its clients together with Zscaler,” reads Zscaler’s advisory.
“Following an in depth evaluation as a part of our ongoing investigation, we’ve decided that these credentials have allowed restricted entry to some Zscaler’s Salesforce data.”
The uncovered data consists of the next:
- Names
- Enterprise e-mail addresses
- Job titles
- Telephone numbers
- Regional/location particulars
- Zscaler product licensing and business data
- Content material from sure assist circumstances
The corporate stresses that the information breach solely impacts its Salesforce occasion and no Zscaler merchandise, companies, or infrastructure.
Whereas Zscaler states that it has detected no misuse of this data, it recommends that clients stay vigilant towards potential phishing and social engineering assaults that might exploit this data.
The corporate additionally says it has revoked all Salesloft Drift integrations to its Salesforce occasion, rotated different API tokens, and is conducting an investigation into the incident.
Zscaler has additionally strengthened its buyer authentication protocol when responding to buyer assist calls to protect towards social engineering assaults.
Google Menace Intelligence warned final week {that a} menace actor, tracked as UNC6395, is behind the assaults, stealing assist circumstances to reap authentication tokens, passwords, and secrets and techniques shared by clients when requesting assist.
“GTIG noticed UNC6395 focusing on delicate credentials similar to Amazon Internet Companies (AWS) entry keys (AKIA), passwords, and Snowflake-related entry tokens,” studies Google.
“UNC6395 demonstrated operational safety consciousness by deleting question jobs, nonetheless logs weren’t impacted and organizations ought to nonetheless evaluation related logs for proof of knowledge publicity.”
It was later revealed that the Salesloft supply-chain assault not solely impacted Drift Salesforce integration, but additionally Drift E mail, which is used to handle e-mail replies and manage CRM and advertising and marketing automation databases.
Google warned final week that attackers additionally used stolen OAuth tokens to entry Google Workspace e-mail accounts and browse emails as a part of this breach.
Google and Salesforce have quickly disabled their Drift integrations pending the completion of an investigation.
Some researchers have instructed BleepingComputer that they imagine the Salesloft Drift compromise overlaps with the current Salesforce knowledge theft assaults by the ShinyHunters extortion group.
For the reason that starting of the 12 months, the menace actors have been conducting social engineering assaults to breach Salesforce situations and obtain knowledge.
Throughout these assaults, menace actors conduct voice phishing (vishing) to trick staff into linking a malicious OAuth app with their firm’s Salesforce situations.
As soon as linked, the menace actors used the connection to obtain and steal the databases, which had been then used to extort the corporate by means of e-mail.
Since Google first reported the assaults in June, quite a few knowledge breaches have been tied to the social engineering assaults, together with Google itself, Cisco, Farmers Insurance coverage, Workday, Adidas, Qantas, Allianz Life, and the LVMH subsidiaries Louis Vuitton, Dior, and Tiffany & Co.
46% of environments had passwords cracked, practically doubling from 25% final 12 months.
Get the Picus Blue Report 2025 now for a complete take a look at extra findings on prevention, detection, and knowledge exfiltration traits.
