Zscaler Warns of Data Breach

In a blog post, Zscaler shared information about the data breach. Salesloft is the developer of the sales engagement platform Drift, a chat application that integrates with Salesforce. This integration allows information collected through Drift to be made available in Salesforce’s CRM software, among other things. Salesloft warned of a cyberattack late last month. Attackers abused OAuth credentials from the Drift application to gain access to customers’ Salesforce environments.

During this campaign, unauthorized actors gained access to Salesforce Drift credentials belonging to customers, including Zscaler. After a detailed review as part of our ongoing investigation, we determined that these credentials granted limited access to certain Zscaler Salesforce information. Zscaler reports that it has, among other things, broken Drift’s access to Salesforce data. Other API access tokens have also been changed as a precaution. Zscaler reports that it is working closely with Salesforce in the investigation into the security incident and is taking measures to prevent a recurrence.

The company advises customers to be extra vigilant, particularly against phishing attacks and social engineering, where malicious actors can exploit information stolen from Zscaler.

“Given that other organizations have suffered similar incidents stemming from Salesloft Drift, it’s crucial to exercise caution regarding unsolicited communications, including emails, phone calls, or requests for sensitive information. Always verify the source of communication and never disclose passwords or financial data via unofficial channels.”