Cloudflare and Palo Alto Networks are the latest big names to have had their Salesforce instances accessed by threat actors via the Salesloft Drift app, the firms have revealed. In a post yesterday, Cloudflare said it became aware of suspicious activity in its Salesforce tenant last week. “Our investigation showed the threat actor compromised and exfiltrated data from our Salesforce tenant between August 12-17, 2025, following initial reconnaissance observed on August 9, 2025,” it continued. “A detailed analysis confirmed the exposure was limited to Salesforce case objects, which primarily consist of customer support tickets and their associated data within our Salesforce tenant.” Salesforce case objects include customer contact information related to support cases, case subject lines and…