Palo Alto Networks data breach (2025): Salesforce data taken through the Salesloft Drift compromise
Palo Alto Networks sells firewalls, Prisma and the Cortex XSIAM security operations platform. In 2025 it was one of hundreds of companies whose Salesforce data was taken through stolen OAuth tokens for the Salesloft Drift chat app. Its products were not affected; its customer contact and support-case records were.
Short answer
Was Palo Alto Networks hacked?
Yes, through a third party. Palo Alto Networks confirmed in September 2025 that an attacker used compromised OAuth tokens from the Salesloft Drift integration to access its Salesforce environment and extract “primarily business contact and related account information”, plus “internal sales account records and basic case data”. Google tracks the actor as UNC6395 and dates the theft wave to 8–18 August 2025.
Palo Alto Networks said the support case data held contact details and text comments, not technical support files or attachments, and that its Unit 42 investigation found no impact on its products, systems or services. It said it was “one of hundreds of customers impacted” and was contacting a limited number of customers whose data may have been more sensitive.
Timeline at a glance
8–18 Aug 2025UNC6395 uses stolen Drift OAuth tokens to export data from Salesforce instances. (Google Threat Intelligence)Confirmed
26 Aug 2025Google warns the actor is mining stolen data for AWS keys, passwords and Snowflake tokens. (Google Threat Intelligence)Confirmed
2 Sep 2025Palo Alto Networks confirms contact, account and basic support-case data was taken. (BleepingComputer)Confirmed
2 Sep 2025Unit 42 publishes a threat brief: rotate any credentials found in exfiltrated Salesforce data. (Unit 42)Confirmed
Last updated 1 November 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Palo Alto Networks incident timeline, in detail
Confirmed = acknowledged by Palo Alto Networks, a regulator filing or a court. Reported = credible reporting Palo Alto Networks has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Aug – Sep 2025ConfirmedThird-party SaaS / OAuth token theft
Salesforce contact, account and support-case data taken via Salesloft Drift OAuth tokens
What happened. Attackers who had stolen OAuth tokens for Salesloft’s Drift chat integration used them to query and export data from Salesforce instances connected to Drift, between 8 and 18 August 2025 per Google and Salesloft. Palo Alto Networks confirmed its Salesforce environment was one of them; it disabled the Drift app and revoked the integration.
Impact. Palo Alto Networks said the attacker took business contact and account information, internal sales account records and basic case data; case data was contact information and text comments, with no support files or attachments. BleepingComputer first heard of the breach from Palo Alto Networks customers worried that passwords or IT details pasted into support cases were exposed. Unit 42 found no impact on products, systems or services.
Why it matters: the actor hunted the stolen data for credentials
What happened. Google’s Threat Intelligence Group said UNC6395 searched exported Salesforce data for secrets, specifically AWS access keys, passwords and Snowflake-related access tokens, and assessed that harvesting credentials was the primary goal.
Impact. Anything a customer pasted into a Palo Alto Networks support case, such as a password, API key or config snippet, should be treated as exposed.
Support tickets: early reports said full support tickets were exposed; BleepingComputer updated its story the same day after Palo Alto Networks said only contact information and text comments were taken, with no files or attachments.
How many Palo Alto Networks customers were affected has not been published; the company said it was contacting a limited number whose data may have been more sensitive.
The pattern across the record
Your vendor’s CRM is part of your attack surface
Nothing in Palo Alto Networks’ products was touched. What leaked was what customers had told the vendor: names, accounts and free-text case notes. Help Net Security’s list of affected firms included Zscaler, SpyCloud and others, so the same exposure applied across many security vendors at once.
OAuth tokens outlive the integration you forgot about
A chat widget on a sales site held long-lived tokens into the CRM. Third-party app tokens need the same inventory and rotation as service-account passwords.
What it means for Palo Alto Networks customers — and what to do
If you are a Palo Alto Networks customer, including Cortex XSIAM or XSOAR, your product deployment was not affected. What may be exposed is what you put in support cases and your contact records.
1.Rotate anything you ever pasted into a support case
Passwords, API keys, log-forwarding or ingest tokens and config snippets shared in Palo Alto Networks support cases should be rotated. Verify the new secret works before revoking the old one.
Its Salesforce environment was accessed through the 2025 Salesloft Drift compromise, and business contact, account and basic support-case data was taken. Palo Alto Networks said its products, systems and services were not affected.
What data did Palo Alto Networks lose in the Drift breach?+
Business contact and related account information, internal sales account records and basic support-case data (contact details and text comments). The company said no technical support files or attachments were taken.
Were Palo Alto Networks firewalls or Cortex affected?+
No. Palo Alto Networks said its Unit 42 investigation found no impact on its products, systems or services.
Who was behind the Salesloft Drift attacks?+
Google tracks the actor as UNC6395. It used OAuth tokens stolen from Salesloft’s Drift integration to export data from Salesforce instances between 8 and 18 August 2025.
What should Palo Alto Networks customers do?+
Rotate any credentials or tokens you shared in support cases, warn your account contacts about targeted phishing, and review third-party OAuth apps in your own SaaS tools.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Palo Alto Networks. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. Claim 3 months for $5 →