zscaler.com August 30, 2025
Zscaler swiftly mitigates a security incident impacting Salesloft Drift, and ensuring robust protection against potential vulnerabilities.
At Zscaler, protecting your data and maintaining transparency are core to our mission to secure, simplify and accelerate businesses transformation. We are committed to keeping you informed about key developments that may impact your organization.

What Happened?

Zscaler was made aware of a campaign targeted at Salesloft Drift (marketing software-as-a-service) and impacting a large number of Salesforce customers. This incident involved the theft of OAuth tokens connected to Salesloft Drift, a third-party application used for automating sales workflows that integrates with Salesforce databases to manage leads and contact information.

The scope of the incident is confined to Salesforce and does not involve access to any of Zscaler's products, services or underlying systems and infrastructure.

As part of this campaign, unauthorized actors gained access to Salesloft Drift credentials of its customers including Zscaler. Following a detailed review as part of our ongoing investigation, we have determined that these credentials have allowed limited access to some Zscaler Salesforce information.

What Information May Be Affected?

The information accessed was limited to commonly available business contact details for points of contact and specific Salesforce related content, including:

Names
Business email addresses
Job titles
Phone numbers
Regional/location details
Zscaler product licensing and commercial information
Plain text content from certain support cases [this does NOT include attachments, files, and images]

After extensive investigation, Zscaler has currently found no evidence to suggest misuse of this information. If anything changes, we will provide further communications and updates.

What Did Zscaler Do?

Zscaler acted swiftly to address the incident and mitigate risks. Steps taken include:

Revoking Salesloft Drift’s access to Zscaler’s Salesforce data
Out of an abundance of caution, rotating other API access tokens.
Launching a detailed investigation into the scope of the event, working closely with Salesforce to assess and understand impacts as they continue investigating.
Implementing additional safeguards and strengthening protocols to defend against similar incidents in the future.
Immediately launched a third party risk management investigation for third party vendors used by Zscaler.
Zscaler Customer Support team has further strengthened customer authentication protocol when responding to customer calls to safeguard against potential phishing attacks.

What You Can Do

Although the incident’s scope remains limited (as stated above) and no evidence of misuse has been found, we recommend that customers maintain heightened vigilance. Please be wary of potential phishing attacks or social engineering attempts, which could leverage exposed contact details.

Given that other organizations have suffered similar incidents stemming from Salesloft Drift, it’s crucial to exercise caution regarding unsolicited communications, including emails, phone calls, or requests for sensitive information. Always verify the source of communication and never disclose passwords or financial data via unofficial channels.

Zscaler Support will never request authentication or authorization details through unsolicited outreach, including phone calls or SMS. All official Zscaler communications come from trusted Zscaler channels. Please exercise caution and report any suspicious phishing activity to security@zscaler.com.