Zscaler Warns of Salesloft Drift Breach Impacting Salesforce Users

Zscaler, a cybersecurity firm with one of the largest security cloud infrastructures in the world, disclosed a Salesloft Drift supply chain incident impacting many of its Salesforce customers. Hackers reportedly stole Salesloft Drift OAuth and refresh tokens, potentially enabling unauthorized access to Salesforce environments.

In its announcement, Zscaler stressed that none of its other products were compromised in the process. However, they warned that, while it’s unlikely that threat actors can use the stolen information to directly compromise Zscaler customers’ instances, it can be used in further social engineering or phishing scams.

The data stolen is comprised of the following:

• Names
• Business email addresses
• Job titles
• Phone numbers
• Regional/location details
• Zscaler product licensing and commercial information
• Plain text content from certain support cases

This information could be used to effectively impersonate Zscaler support staff and trick customers into providing further sensitive information or environment access. However, they stated that an extensive investigation “found no evidence to suggest misuse of this information” had already taken place.

Zscaler has also taken numerous precautions to limit the potential impact of the hack and give customers time to respond, including revoking Salesloft Drift access to Zscaler’s Salesforce data and rotating all other API access tokens.

They’ve also committed to implementing additional safeguards, launching a third-party risk management investigation, and stricter authentication protocols when responding to customer support queries.

While no link is confirmed as of yet, the incident is eerily reminiscent of a global wave of Salesforce OAuth token thefts. Tracked as UNC6395 by Google Threat Intelligence, the first incidents were traced back to Aug. 8, 2025, and have claimed many high-profile victims, such as Qantas, Adidas, and even Google itself.

Google is warning all Salesloft Drift customers to “treat any and all authentication tokens stored in or connected to the Drift platform as potentially compromised.”

The threat group behind the spate of attacks has not been definitively identified. However, some suspect ShinyHunters, a notorious hacking group also behind one of the largest data breaches of all time, impacting Ticketmaster.