Zscaler confirms data breach caused by Salesloft Drift supply chain attack
Learn More
Cybersecurity company Zscaler is reporting a data breach affecting its Salesforce instance after hackers compromised Salesloft Drift, an AI-powered chat agent integrated with Salesforce databases.
Between August 8-18, 2025, attackers systematically compromised OAuth tokens associated with Salesloft Drift, enabling them to gain unauthorized access to customer Salesforce environments and exfiltrate sensitive data.
Zscaler became aware of the targeted campaign on August 28, 2025, when its security team was alerted to the widespread attacks affecting Salesloft Drift customers. The company claims that the incident was confined to its Salesforce environment and did not affect any of its core security products, services, or underlying infrastructure.
The unauthorized access allowed threat actors to view and extract customer contact information and support case contents stored within Zscaler's Salesforce instance. Exposed data includes:
- Names of customer contacts and business associates
- Business email addresses
- Job titles and professional roles
- Phone numbers
- Regional and location details
- Zscaler product licensing information
- Commercial and contractual information
- Content from certain customer support cases (excluding file attachments)
The number of affected individuals is not disclosed.
The exposed information was described as "commonly available business contact details" and specific Salesforce-related content. Zscaler claims that file attachments and other sensitive documents within support cases remained unaffected by the breach.
Zscaler revoked all Salesloft Drift integrations to its Salesforce instance and rotated other API access tokens as a precautionary measure.
On August 20, 2025, Salesloft and Salesforce collaborated to revoke all active access and refresh tokens associated with the Drift application.
Zscaler has strengthened its customer authentication protocols when responding to support calls to guard against social engineering attacks that could exploit the exposed contact information. The company has also initiated a comprehensive third-party risk management review of all vendors used by Zscaler and implemented additional safeguards to defend against similar supply chain attacks in the future.
