Palo Alto Networks reports data breach caused by Salesloft Drift supply chain attack
Learn More
Palo Alto Networks is reporting a data breach affecting its Salesforce customer relationship management (CRM) environment after attackers used stolen OAuth credentials from the compromised Salesloft Drift platform to gain access to sensitive business information.
The breach is caused by a compromise of Salesloft's Drift artificial intelligence chat application, which maintained OAuth token-based integration with Palo Alto Networks' Salesforce environment. Attackers exploited stolen authentication credentials to gain access to the company's CRM platform between August 8 and August 18, 2025.
Palo Alto Networks claims that the incident was isolated to the Salesforce environment and did not affect any of the company's security products, systems, or services. Exposed data includes:
- Customer business contact information, including names and contact details
- Company attributes and organizational information
- Basic customer support case information and metadata
- Internal sales account details and customer relationship data
The number of affected individuals is not disclosed.
Palo Alto Networks claims that no technical support files or attachments to customer support cases were included in the data exfiltration.
Palo Alto Networks revoked all associated OAuth tokens and rotated affected credentials following the incident discovery. Their Unit 42 incident response team continues to conduct forensic analysis. Palo Alto Networks is reaching out to a limited number of customers who may have had more commercially sensitive data exposed.
