Palo Alto, Salesforce-Connected Third-Party Drift Application Incident Response

DefenseStorm is aware of recent reports regarding a breach involving Palo Alto and certain types of data. Please see the most recent update below, taken directly from Palo Alto’s blog page about the incident.

The source page can be found here: https://www.paloaltonetworks.com/blog/2025/09/salesforce-third-party-application-incident-response/.

Last week, Salesloft announced its Drift application was breached, which provided unauthorized access to its customers’ Salesforce data. This supply chain attack impacted hundreds of organizations, including Palo Alto Networks.

As soon as we learned of the event, we disconnected the vendor from our Salesforce environment and our Unit 42 security teams launched a comprehensive investigation. Our investigation confirms the incident was isolated to our CRM platform; no Palo Alto Networks products or services were impacted, and they remain secure and fully operational. The data involved includes mostly business contact information, internal sales account and basic case data related to our customers.

We take this incident seriously and are reaching out to a limited number of customers who have potentially more sensitive data exposed.

If you have concerns or need additional support, our teams are available via Palo Alto Networks customer support channels.

For additional technical details, guidance for breach victims, and recommended mitigations, please refer to our Unit 42 Threat Brief.

DefenseStorm Response

DefenseStorm is recommending everyone who uses Palo Alto to review any advisories received or published from Palo Alto and evaluate if they apply to your organization.

DefenseStorm always recommends applying any changes in accordance with your existing internal policies and change controls.

Please bookmark: https://www.paloaltonetworks.com/blog/2025/09/salesforce-third-party-application-incident-response/ to stay up to date with the latest developments related to this incident.

Vulnerability [Urgent] Apple Zero-Day Security Release

James Bruhl

Director of Cyber Threat Intelligence

James Bruhl is the Director of Cyber Threat Intelligence for DefenseStorm. He joined the company with 15 years of experience as a law enforcement officer, bringing extensive experience in crime prevention, evidence collection, investigative techniques, and crisis management. Driven by a passion for technological advancements and the ever-evolving landscape of digital threats, he transitioned to the field of digital forensics, incident response, and cybersecurity. In his role, he honed his skills in analyzing digital evidence, identifying cyber threats, and implementing robust security measures specializing in forensic examinations on various devices to uncover critical information and support investigations. James began at DefenseStorm as a security engineer in 2020 and developed DefenseStorm’s EDR Service. He was then appointed as Director of Cyber Threat Intelligence in 2022 and is responsible for nearly all facets of the EDR service. During his cyber career, James has been instrumental in proactively detecting and responding to cyber incidents and plays a vital role in incident response teams, coordination efforts to mitigate the impact of breaches, vulnerability identification, and strategy implementation to prevent future attacks. He continues to share his expertise by conducting training sessions, participating in conferences, and writing articles on topics related to digital forensics, incident response, and cybersecurity. James holds a bachelor’s in criminal justice from the University of North Georgia and a GCFE certification.