Palo Alto Networks suffered a data breach that exposed customer data and support cases after attackers abused compromised OAuth tokens from the Salesloft Drift breach to access its Salesforce instance.
The company states that it was one of hundreds of companies affected by a supply-chain attack disclosed last week, in which threat actors abused the stolen authentication tokens to exfiltrate data.
BleepingComputer learned of the breach this weekend from Palo Alto Networks' customers, who expressed concern that the breach exposed sensitive information, such as IT information and passwords, shared in support tickets.
Palo Alto Networks later confirmed to BleepingComputer that the incident was limited to its Salesforce CRM and did not affect any products, systems, or services.
"Palo Alto Networks confirms that it was one of hundreds of customers impacted by the widespread supply chain attack targeting the Salesloft Drift application that exposed Salesforce data," Palo Alto Networks told BleepingComputer.
"We quickly contained the incident and disabled the application from our Salesforce environment. Our Unit 42 investigation confirms that this situation did not affect any Palo Alto Networks products, systems, or services."
"The attacker extracted primarily business contact and related account information, along with internal sales account records and basic case data. We are in the process of directly notifying any impacted customers."
The campaign, first tracked by Google's Threat Intelligence team as UNC6395, specifically targeted support cases to identify sensitive data, such as authentication tokens, passwords, and cloud secrets, that could be used to pivot into other cloud services and steal data.
"Our observations indicate that the threat actor performed mass exfiltration of sensitive data from various Salesforce objects, including Account, Contact, Case and Opportunity records," Palo Alto Networks warned in an advisory shared with BleepingComputer.
"Following exfiltration, the actor appeared to be actively scanning the acquired data for credentials, likely with the intent to facilitate further attacks or expand their access. We have observed that the threat actor deleted queries to hide evidence of the jobs they run, likely as an anti-forensics technique.
... continue reading