Article Details

Zscaler latest victim of Salesloft Drift attacks, customer data exposed. Joins Google, Palo Alto Networks in the ever-growing supply chain compromise. Zscaler is the latest company to disclose some of its customers' data was exposed in the recent spate of Salesloft Drift attacks affecting Salesforce databases. "Following a detailed review as part of our ongoing investigation, we have determined that these credentials have allowed limited access to some Zscaler Salesforce information," the cloud security shop's VP and Chief Information Security Officer Sam Curry said in an August 30 blog. The stolen information includes Salesforce-related content including names, business email addresses, job titles, phone numbers, regional/location details, Zscaler product licensing and commercial information, and plain text content from certain support cases — although Zscaler noted "this does NOT include attachments, files, and images." The security snafu occurred between August 8 and August 18, during which time a group suspected to be ShinyHunters (UNC6395) stole OAuth tokens from Salesloft Drift's integration with Salesforce.  Drift, a third-party application used to automate sales processes, integrates with Salesforce databases to help manage leads and coordinate pitches, and compromising these OAuth security tokens allowed the data thieves to silently steal a ton of Salesforce customer data. "Our observations indicate that the threat actor performed mass exfiltration of sensitive data from various Salesforce objects, including Account, Contact, Case, and Opportunity records," Palo Alto Networks' Unit 42 incident responders warned today, after PAN's Chief Information Security Officer Marc Benoit confirmed to his company's customers that their commercial data may have also been exposed in the Drift break-in." "Following exfiltration, the actor appeared to be actively scanning the acquired data for credentials, likely with the intent to facilitate further attacks or expand their access," Unit 42 continued. Last week, we learned that the Salesforce data theft also hit some Google Workspace accounts, and, over the weekend, Zscaler said that the criminals also accessed its Drift credentials. At this time, there's no evidence of misuse. The Register asked Zscaler what "limited scope" means, and how many customers were affected, but did not receive an immediate response. The security firm also suggests customers revoke Salesloft Drift access to Zscaler's Salesforce data and rotate other API access tokens to be extra safe.  This follows similar advice from Google last week, and Unit 42 today, both of which recommend anyone using Drift integrations revoke and rotate credentials for those applications. Unit 42 also advises users to check login histories and API access logs from August 8 forward while hunting for signs of any suspicious connections, credential theft, or data exfiltration.