Supply Chain Attack
Zscaler warns of support-case and contact data exposure after Salesloft Drift br...
Zscaler has disclosed a data breach affecting its Salesforce environment after attackers exploited the compromise of Salesloft’s Drift platform, a third-party tool widely connected to customer relationship management (CRM) systems. Contact information from some customers and text from select support cases were exposed, though the company stressed that its products or infrastructure were not impacted.
## Breach Origin
The incident stems from a campaign in which attackers stole OAuth and refresh tokens tied to Drift integrations. Those stolen tokens allowed unauthorized access into Salesforce environments, where large-scale queries were executed against CRM objects such as Accounts, Users, Opportunities, and Cases. Google Threat Intelligence attributes the operation to an actor it tracks as **UNC6395**, with activity observed between August 8 and August 18, 2025.
## Data Exposure
According to Zscaler, the breach revealed customer names, business emails, job titles, phone numbers, geographic details, commercial data, licensing records, and text from a subset of support cases. File attachments were not included in the exposure. The company has clarified that the affected data was limited strictly to Salesforce and did not touch any of its cloud products.
## Company Response
Following detection, Zscaler revoked Drift integrations, rotated API tokens, initiated a joint investigation with Salesforce, and introduced stricter authentication checks for customer support. The firm confirmed that no misuse of the accessed data has been observed so far.
## Expanded Threat
Google has since reported that the Drift compromise extended beyond Salesforce, impacting **Drift Email** users as well. Stolen tokens were used to access some Google Workspace accounts that had integrated Drift services. Both Google and Salesforce disabled Drift integrations while security reviews progressed. Google has advised all organizations with Drift connections to rotate credentials immediately.
## Attack Attribution
The wider campaign resembles Salesforce data-theft incidents carried out earlier this year by groups including **ShinyHunters**, which targeted enterprises such as Cisco and Workday. These intrusions often begin with vishing calls that trick employees into approving malicious OAuth apps, enabling large-scale data exfiltration without malware. Whether UNC6395 is directly linked to ShinyHunters remains unconfirmed, but the operational overlap is notable.
## Customer Guidance
Zscaler is urging customers to be alert for phishing attempts, verify any unexpected requests for information, and rely exclusively on official support channels. Security teams are encouraged to review integration inventories, revoke Drift tokens, check Salesforce logs for suspicious queries, and rotate any credentials referenced in exposed support cases.
The breach illustrates how quickly trust in SaaS ecosystems can be weaponized. While Zscaler has reassured customers that its services remain unaffected, the incident underlines the risks posed by third-party integrations. With attackers exploiting OAuth trust relationships instead of deploying malware, enterprises must adopt tighter monitoring of API connections and apply stricter lifecycle management for tokens.
