Zscaler data breach exposes customer info after Salesloft Drift compromise

Zscaler disclosed a data breach where attackers used stolen Salesloft Drift credentials to access its Salesforce instance and exfiltrate customer details (names, business emails, job titles, phone numbers, regional info, product licensing/commercial info) and support-case contents. The incident is tied to a broader campaign—attributed by Google to UNC6395—where social-engineering (vishing) and stolen OAuth/refresh tokens were used to access Salesforce and Google Workspace accounts, impacting numerous organizations and prompting revocation of integrations and token rotations.