Zscaler confirms data breach affecting its Salesforce system

Zscaler has discovered a data breach after attackers accessed its Salesforce environment through compromised credentials from Salesloft Drift, an AI chat agent that integrates with Salesforce. The breach stems from a wider supply-chain attack on Salesloft Drift in which threat actors stole OAuth and refresh tokens. These tokens granted unauthorized access to Salesforce customer instances, allowing sensitive information to be exfiltrated.

Zscaler, in its advisory, confirmed its Salesforce instance was among those impacted. It stated, “As part of this campaign, unauthorized actors gained access to Salesloft Drift credentials of its customers including Zscaler,” the company stated. “Following a detailed review, we determined these credentials allowed limited access to certain Salesforce data.”

The compromised data includes -

·         Customer names

·         Business email addresses

·         Job titles

·         Phone numbers

·         Regional/location details

·         Product licensing and commercial details

·         Content from certain customer support cases

Zscaler further emphasized that the breach only affected its Salesforce system and that no Zscaler products, infrastructure, or services were compromised. Despite this, the company urged customers to remain alert for phishing or social engineering attempts leveraging the exposed data.

As the company continues to investigate the incident, Zscaler as mitigation step has-

·         Revoked all Salesloft Drift integrations with Salesforce

·         Rotated API tokens

·         Enhanced customer authentication during support calls to reduce social engineering risks

Google Threat Intelligence recently attributed the Drift compromise to a group tracked as UNC6395, which has been stealing Salesforce support cases to harvest credentials, AWS access keys, Snowflake tokens, and other sensitive data.

According to Google, UNC6395 also displayed operational security tactics—such as deleting query jobs to obscure activity—though logs remained intact for forensic review. The campaign extends beyond Drift’s Salesforce integration. Attackers also exploited Drift Email, gaining access to CRM and marketing automation data, and even used stolen OAuth tokens to infiltrate Google Workspace accounts to read corporate emails.