SUPPLY-CHAIN ATTACK HITS ZSCALER VIA SALESLOFT DRIFT, LEAKING CUSTOMER INFO

Summary from the TLDR InfoSec newsletter

Zscaler confirmed that a threat actor compromised OAuth tokens via the Salesloft Drift integration from August 8 to 18, exposing business contacts and Salesforce data. Though core infrastructure remained secure, the breach revealed names, emails, job titles, phone numbers, and licensing info. The attack extended beyond Salesforce, targeting AWS keys and Snowflake tokens across multiple organizations. Zscaler revoked Drift's access and rotated API tokens.