Palo Alto Networks data breach exposes customer info, support cases

Palo Alto Networks confirmed it was among hundreds of organizations impacted by a Salesloft Drift supply-chain breach in which stolen OAuth tokens were used to access Salesforce instances and mass-exfiltrate Account, Contact, Case and Opportunity data; attackers searched for credentials and secrets to enable further cloud pivots, used automated Python tools and Tor, and deleted logs as an anti-forensics measure, while victims have revoked tokens and rotated credentials.