Zscaler Says Stolen Drift OAuth Tokens Exposed Salesforce Data

Zscaler disclosed on Aug. 30 that unauthorized actors used stolen OAuth credentials tied to the Salesloft Drift application to access its Salesforce customer relationship management instance, exposing business contact information and the contents of certain support cases. The company said the intrusion was part of a wider supply chain campaign that has affected hundreds of organizations that integrate Drift with Salesforce and other services.

In an advisory, Zscaler said "unauthorized actors gained access to Salesloft Drift credentials of its customers including Zscaler," and that the access allowed limited visibility into some Salesforce information. The company said exposed data included names, business email addresses, job titles, phone numbers, region and location details, product licensing and commercial information, and content from specific support cases. Zscaler stressed that its products, services and core infrastructure were not compromised and that it has found no evidence so far of misuse, but urged customers to remain vigilant against phishing and social engineering.

Security researchers and vendors tracing the campaign say the intrusions stem from a compromise of...