Palo Alto Networks, Zscaler customers impacted by supply chain attacks

Palo Alto Networks and Zscaler, prominent cybersecurity firms, have both disclosed data breaches originating from a supply chain incident involving Salesloft Drift, which compromised their Salesforce customer relationship management (CRM) platforms. Palo Alto Networks stated the breach was limited to business contact and basic case data within its CRM, with no impact on its products or systems, while Zscaler reported access to commonly available business contact and product licensing information, affecting a large number of customers. The attacks, attributed to threat actor UNC6395, exploited compromised OAuth tokens associated with Salesloft Drift to target Salesforce instances, a campaign Google Threat Intelligence Group identified as more widespread than initially thought, impacting hundreds of potential targets. Salesforce has since disabled all integrations with Salesloft Drift, highlighting the significant supply chain risk posed by third-party integrations with critical enterprise platforms.

Analysis

A sophisticated supply chain attack originating from the Salesloft Drift platform has resulted in data breaches at two leading cybersecurity firms, Palo Alto Networks (PANW) and Zscaler (ZS), exposing vulnerabilities within their Salesforce (CRM) environments. According to the companies, the breaches did not compromise their core products or services but were limited to their customer relationship management platforms. PANW reported that accessed data included business contact information and internal sales data, stating a 'limited number of customers' were affected. In contrast, Zscaler disclosed that a 'large number of customers' were impacted, with hackers accessing business contact data and Zscaler product licensing information, a potentially more sensitive category. The market's moderately negative sentiment (PANW/ZS sentiment at -0.4) reflects the reputational risk for cybersecurity vendors experiencing a breach, even if contained. The incident, attributed by Google's Threat Intelligence Group to the actor UNC6395, highlights a significant and widespread threat, with hundreds of potential targets. Salesforce's reactive measure of disabling all Salesloft Drift integrations underscores the systemic risk posed by third-party applications on major enterprise platforms, a concern reflected in its -0.5 sentiment score.

Key Decisions for Investors

• Investors in Palo Alto Networks (PANW) and Zscaler (ZS) should closely monitor for any customer attrition or delays in sales cycles, as the breach of client data could erode trust despite company assurances that core products were unaffected.
• The incident exposes platform risk for Salesforce (CRM), so investors should assess potential fallout from increased scrutiny on its third-party app ecosystem, which could lead to stricter governance and impact platform growth.