Stolen OAuth tokens expose Palo Alto customer data

Palo Alto Networks disclosed that attackers leveraged stolen OAuth credentials from the Salesloft/Drift breach to access and exfiltrate customer business contact data from its Salesforce instance; the company isolated the incident to CRM data, disconnected the third-party integration, and Unit 42 recommends token revocation and auditing Salesforce, Salesloft, identity provider, and API logs while performing enhanced monitoring.