Zscaler customer data leaked in Salesloft Drift breach
SpilloverSpillover from the Salesloft incident · View original incident →Zscaler confirmed a leak of customer information resulting from the Salesloft Drift supply chain breach. A follow-up investigation revealed that the attacker accessed Salesloft's GitHub account from March to June for reconnaissance and then stole OAuth tokens used for customer integrations from Drift's AWS environment. The attacker used these tokens to exfiltrate Salesforce data.
Key facts
- Affected organisation
- Zscaler
- Original incident
- Fallout continues from breach at AI chatbot firm Salesloft
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Customer information leaked, scale unknown
- Cause / method
- After compromising Salesloft's GitHub account, OAuth tokens for customer integrations were stolen from Drift's AWS environment and used to access Salesforce data
- Location
- United States
If your data was exposed
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- Zscaler confirmed a leak of customer information resulting from the Salesloft Drift breach.
- It was revealed that the attacker accessed a GitHub account from March to June, then stole OAuth tokens from Drift's AWS environment and used them to exfiltrate Salesforce data.
Original incident
This is spillover from the Salesloft incident.
Fallout continues from breach at AI chatbot firm Salesloft
A data breach occurred at AI chatbot company Salesloft. The fallout from the breach continues, and the specific scale of the damage, attack method and response measures have not been confirmed.
Read on Krebs on Security ↗
10 related reports
- Zscaler Confirms Data Breach After Salesloft Drift Supply-Chain Compromise
- Zscaler data breach exposes customer info after Salesloft Drift compromise
- Zscaler falls victim to Salesloft Drift supply chain hack
- Salesloft Drift Breach: Everything You Need to Know
- Zscaler discloses data breach after cyberattack on third party
- Salesloft Drift data breach: Investigation reveals how attackers got in
- Salesloft Drift security incident started with undetected GitHub access
- Salesloft Drift hack dates back to a March compromise of the company’s GitHub account
- Salesloft GitHub Account Compromised Months Before Salesforce Attack
- Hackers steal 3,325 secrets in GhostAction GitHub supply chain attack
Other incidents at Zscaler
Zscaler confirms hack of isolated test server
Impact: One isolated test server
Uncertainty arose over whether Zscaler had been breached. On 14 May 2024, Zscaler confirmed that the hack was limited to an isolated test server.
Related reports: 2 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.