Palo Alto Networks has disclosed a data breach after attackers exploited compromised OAuth tokens from the Salesloft Drift incident to access its Salesforce environment. The breach exposed customer contact details and support case records, raising concerns about the potential misuse of sensitive information.
The company emphasized that the attack was part of a larger supply-chain campaign impacting hundreds of organizations worldwide. Google’s Threat Intelligence team, which tracks the threat actor as UNC6395, reported that attackers specifically targeted Salesforce objects—such as Account, Contact, Case, and Opportunity records—searching for valuable information like authentication tokens, passwords, and cloud secrets.
According to Palo Alto Networks, the exfiltrated data included business contact details, internal sales account information, and basic case data. Crucially, the company confirmed that no technical support files, product data, or system information were exposed. The breach was confined to its Salesforce CRM platform and did not affect any of its products, services, or operational systems.
In a statement, the company said it acted quickly to contain the breach by disabling the compromised application from its Salesforce instance. “Our Unit 42 investigation confirms that this situation did not affect any Palo Alto Networks products, systems, or services,” the company assured.
The attackers also engaged in anti-forensic tactics, deleting queries to conceal their activity after mass data exfiltration. Palo Alto Networks is in the process of notifying impacted customers directly and continues to assess potential risks from the incident.
This breach highlights the growing security challenges in SaaS ecosystems, where a compromise in one third-party platform can cascade into widespread data exposure across multiple organizations. Security experts caution enterprises to review integrations, rotate credentials, and strengthen monitoring of SaaS environments to mitigate such risks.
See What’s Next in Tech With the Fast Forward Newsletter
Tweets From @varindiamag
Nothing to see here - yet
When they Tweet, their Tweets will show up here.
