Incident Types: The types of cybersecurity incidents that have occurred include Vulnerability and Breach.

Detection and Response: The company detects and responds to cybersecurity incidents through an remediation measures with immediate updates to patched software versions, and remediation measures with upgrade to pan-os 11.2.6, 11.1.10, 10.2.14, or 10.1.14-h15, and and third party assistance with salesforce, third party assistance with salesloft, third party assistance with google’s threat intelligence group, and containment measures with disabled vulnerable salesloft-drift integration (palo alto networks), containment measures with revoked affected oauth tokens, containment measures with launched third-party risk management investigation (zscaler), and remediation measures with strengthened customer authentication protocols (zscaler), remediation measures with reviewing internal safeguards (palo alto networks), remediation measures with customer notifications, and communication strategy with public disclosures (pagerduty, zscaler, palo alto networks), communication strategy with customer advisories (e.g., palo alto networks via linkedin), communication strategy with recommendations for heightened phishing vigilance, and enhanced monitoring with heightened vigilance for phishing (recommended to customers), and containment measures with urgent patching to remediated versions, containment measures with hotfix application (e.g., 10.2.13-h3, 11.1.6-h1), and product with pan-os 10.2, action with upgrade to 10.2.14 or apply hotfix 10.2.13-h3+, product with pan-os 11.1, action with upgrade to 11.1.7 or apply hotfix 11.1.6-h1/11.1.4-h13, product with pan-os 11.2, action with upgrade to 11.2.5 or apply hotfixes, product with prisma access, action with palo alto networks completing upgrades (except conflicting maintenance windows), and communication strategy with public advisory with remediation guidance, communication strategy with customer notifications for prisma access upgrades, and third party assistance with xbow researchers (vulnerability discovery), and containment measures with disable clientless vpn functionality, containment measures with enable threat prevention ids 510003 and 510004 (applications and threats content version 8970), and remediation measures with upgrade to patched pan-os versions (expected releases: june–august 2025), remediation measures with user awareness training for suspicious links, and communication strategy with public advisory by palo alto networks, and enhanced monitoring with monitor for exploitation attempts via threat prevention signatures..

Common Attack Types: The most common types of attacks the company has faced is Vulnerability.

Identification of Attack Vectors: The company identifies the attack vectors used in incidents through CLI access and Salesloft Drift (third-party SaaS application).

Commonly Compromised Data Types: The types of data most commonly compromised in incidents are Business Contact Details, Sales Account Records, Case Metadata, Social Security Numbers (Transunion Only), , Session Tokens, Credentials and .

Third-Party Assistance: The company involves third-party assistance in incident response through Salesforce, Salesloft, Google’s Threat Intelligence Group, , XBOW Researchers (Vulnerability Discovery), .

Prevention of Data Exfiltration: The company takes the following measures to prevent data exfiltration: Immediate updates to patched software versions, Upgrade to PAN-OS 11.2.6, 11.1.10, 10.2.14, or 10.1.14-h15, Strengthened customer authentication protocols (Zscaler), Reviewing internal safeguards (Palo Alto Networks), Customer notifications, , product: PAN-OS 10.2, action: Upgrade to 10.2.14 or apply hotfix 10.2.13-h3+, product: PAN-OS 11.1, action: Upgrade to 11.1.7 or apply hotfix 11.1.6-h1/11.1.4-h13, product: PAN-OS 11.2, action: Upgrade to 11.2.5 or apply hotfixes, product: Prisma Access, action: Palo Alto Networks completing upgrades (except conflicting maintenance windows), , Upgrade to patched PAN-OS versions (expected releases: June–August 2025), User awareness training for suspicious links, .

Handling of PII Incidents: The company handles incidents involving personally identifiable information (PII) through by disabled vulnerable salesloft-drift integration (palo alto networks), revoked affected oauth tokens, launched third-party risk management investigation (zscaler), , urgent patching to remediated versions, hotfix application (e.g., 10.2.13-h3, 11.1.6-h1), , disable clientless vpn functionality, enable threat prevention ids 510003 and 510004 (applications and threats content version 8970) and .

Key Lessons Learned: The key lessons learned from past incidents are Third-party SaaS integrations introduce significant supply chain risk, even for cybersecurity firms.,OAuth token management requires stricter oversight and monitoring.,Rapid revocation of compromised tokens is critical to limiting exposure.,Customer communication and transparency are essential to maintaining trust post-breach.Criticality of prompt patching for network infrastructure vulnerabilities,Risks of DoS vulnerabilities enabling secondary attacks,Importance of maintenance windows for security updatesClientless VPN introduces elevated risk for reflected XSS vulnerabilities.,Proof-of-concept exploits in the wild necessitate proactive mitigation even before active exploitation is observed.,User training remains critical for mitigating social engineering-based attacks.

Implemented Recommendations: The company has implemented the following recommendations to improve cybersecurity: Implement additional access controls limiting CLI access to essential personnel only. and Immediate updates to patched software versions.

Additional Resources: Stakeholders can find additional resources on cybersecurity best practices at and Source: PagerDuty Public ReportDate Accessed: 2025-08-23, and Source: Zscaler Official BlogDate Accessed: 2025-08-23, and Source: Palo Alto Networks Customer Notification (via LinkedIn)Date Accessed: 2025-08-23, and Source: Google’s Threat Intelligence Group Investigation, and Source: Palo Alto Networks Security Advisory, and Source: Palo Alto Networks Security Advisory, and Source: XBOW Research.

Communication of Investigation Status: The company communicates the status of incident investigations to stakeholders through Public Disclosures (Pagerduty, Zscaler, Palo Alto Networks), Customer Advisories (E.G., Palo Alto Networks Via Linkedin), Recommendations For Heightened Phishing Vigilance, Public Advisory With Remediation Guidance, Customer Notifications For Prisma Access Upgrades and Public Advisory By Palo Alto Networks.

Advisories Provided: The company provides the following advisories to stakeholders and customers following an incident: were Customers Advised To Monitor For Phishing Attempts (Zscaler, Pagerduty)., Palo Alto Networks Notified Impacted Customers Directly., Transunion Disclosed Breach To Affected 4.4 Million Us Consumers., Pagerduty: 'We Will Never Contact Anyone By Phone To Request A Password Or Any Other Secure Details.', Zscaler: 'No Evidence Of Misuse Found, But Customers Should Maintain Heightened Vigilance For Phishing.', Palo Alto Networks: Reviewing Internal Safeguards To Prevent Future Incidents., , Public Security Advisory Issued By Palo Alto Networks, Direct Notifications To Prisma Access Customers For Patch Scheduling, , Palo Alto Networks Customers Using Affected Pan-Os Versions, Apply Mitigations Immediately If Clientless Vpn Is Enabled., Await Official Patches For Long-Term Remediation. and .

Post-Incident Analysis Process: The company's process for conducting post-incident analysis is described as Salesforce, Salesloft, Google’S Threat Intelligence Group, , Heightened Vigilance For Phishing (Recommended To Customers), , Xbow Researchers (Vulnerability Discovery), , Monitor For Exploitation Attempts Via Threat Prevention Signatures, .

Corrective Actions Taken: The company has taken the following corrective actions based on post-incident analysis: Patching and restricting administrative access, Disabled Vulnerable Integrations (Palo Alto Networks)., Revoked Compromised Oauth Tokens., Enhanced Authentication Protocols (Zscaler)., Third-Party Risk Management Investigations Launched., , Code Fixes In Patched Pan-Os Versions To Validate Data Plane Inputs, Enhanced Testing For Dos Resilience In Firewall Software, Proactive Hotfix Distribution For Critical Vulnerabilities, , Code-Level Fixes In Upcoming Pan-Os Patches., Enhanced Threat Prevention Signatures For Xss Detection., .

Last Attacking Group: The attacking group in the last incident were an Unauthenticated Attackers and UNC6395.

Most Recent Incident Detected: The most recent incident detected was on 2025-08-20.

Most Recent Incident Publicly Disclosed: The most recent incident publicly disclosed was on 2025-08-23.

Most Significant Data Compromised: The most significant data compromised in an incident were Business contact details (names, email addresses, job titles, phone numbers), Sales account records, Case metadata, , User Session Cookies, Credentials and .

Most Significant System Affected: The most significant system affected in an incident were Salesforce instances (via third-party integration)Salesloft Drift app and T, y, p, e, :, , P, A, -, S, e, r, i, e, s, , F, i, r, e, w, a, l, l, s, ,, V, e, r, s, i, o, n, s, :, , 1, 0, ., 2, , (, a, l, l, , ≤, , 1, 0, ., 2, ., 1, 3, ), ,, , 1, 1, ., 1, , (, a, l, l, , ≤, , 1, 1, ., 1, ., 6, ), ,, , 1, 1, ., 2, , (, <, , 1, 1, ., 2, ., 5, ), ,, T, y, p, e, :, , V, M, -, S, e, r, i, e, s, , F, i, r, e, w, a, l, l, s, ,, V, e, r, s, i, o, n, s, :, , 1, 0, ., 2, , (, a, l, l, , ≤, , 1, 0, ., 2, ., 1, 3, ), ,, , 1, 1, ., 1, , (, a, l, l, , ≤, , 1, 1, ., 1, ., 6, ), ,, , 1, 1, ., 2, , (, <, , 1, 1, ., 2, ., 5, ), ,, T, y, p, e, :, , P, r, i, s, m, a, , A, c, c, e, s, s, ,, V, e, r, s, i, o, n, s, :, , U, n, d, e, r, l, y, i, n, g, , P, A, N, -, O, S, , v, e, r, s, i, o, n, s, , (, s, e, e, , a, b, o, v, e, ), ,, and GlobalProtect GatewayGlobalProtect PortalClientless VPN.

Third-Party Assistance in Most Recent Incident: The third-party assistance involved in the most recent incident was salesforce, salesloft, google’s threat intelligence group, , xbow researchers (vulnerability discovery), .

Containment Measures in Most Recent Incident: The containment measures taken in the most recent incident were Disabled vulnerable Salesloft-Drift integration (Palo Alto Networks)Revoked affected OAuth tokensLaunched third-party risk management investigation (Zscaler), Urgent patching to remediated versionsHotfix application (e.g., 10.2.13-h3, 11.1.6-h1) and Disable Clientless VPN functionalityEnable Threat Prevention IDs 510003 and 510004 (Applications and Threats content version 8970).

Most Sensitive Data Compromised: The most sensitive data compromised in a breach were Business contact details (names, email addresses, job titles, phone numbers), User Session Cookies, Sales account records, Credentials and Case metadata.

Number of Records Exposed in Most Significant Breach: The number of records exposed in the most significant breach was 4.4M.

Most Significant Lesson Learned: The most significant lesson learned from past incidents was User training remains critical for mitigating social engineering-based attacks.

Most Significant Recommendation Implemented: The most significant recommendation implemented to improve cybersecurity was Implement least-privilege access controls for third-party apps connected to CRM systems like Salesforce., Monitor for anomalous OAuth token usage or unexpected API calls from integrated apps., Conduct third-party risk assessments for all SaaS integrations, especially those with OAuth access., Assess secondary attack surfaces exposed during firewall downtime, Monitor for unusual activity in GlobalProtect portals/gateways., Disable Clientless VPN if not essential to operations., Conduct phishing simulation exercises to raise user awareness., Enhance authentication protocols for customer support interactions to prevent social engineering., Immediately upgrade to patched PAN-OS versions (10.2.14, 11.1.7, 11.2.5+) or apply hotfixes, Review decrypt policies and URL proxy configurations for exposure, Prioritize patching PAN-OS versions based on Clientless VPN usage., Implement additional access controls limiting CLI access to essential personnel only., Immediate updates to patched software versions, Deploy Threat Prevention signatures (IDs 510003, 510004) for affected systems., Prioritize remediation during next maintenance window for Prisma Access, Monitor for signs of exploitation (unexpected reboots, maintenance mode) and Educate employees and customers on phishing risks following data breaches involving contact details..

Most Recent Source: The most recent source of information about an incident are PagerDuty Public Report, Palo Alto Networks Customer Notification (via LinkedIn), Palo Alto Networks Security Advisory, Zscaler Official Blog, XBOW Research and Google’s Threat Intelligence Group Investigation.

Current Status of Most Recent Investigation: The current status of the most recent investigation is Ongoing (Google’s Threat Intelligence Group and affected companies).

Most Recent Stakeholder Advisory: The most recent stakeholder advisory issued was Customers advised to monitor for phishing attempts (Zscaler, PagerDuty)., Palo Alto Networks notified impacted customers directly., TransUnion disclosed breach to affected 4.4 million US consumers., Public security advisory issued by Palo Alto Networks, Palo Alto Networks customers using affected PAN-OS versions, .

Most Recent Customer Advisory: The most recent customer advisory issued were an PagerDuty: 'We will never contact anyone by phone to request a password or any other secure details.'Zscaler: 'No evidence of misuse found, but customers should maintain heightened vigilance for phishing.'Palo Alto Networks: Reviewing internal safeguards to prevent future incidents., Direct notifications to Prisma Access customers for patch scheduling and Apply mitigations immediately if Clientless VPN is enabled.Await official patches for long-term remediation.

Most Recent Entry Point: The most recent entry point used by an initial access broker were an Salesloft Drift (third-party SaaS application) and CLI access.

Most Significant Root Cause: The most significant root cause identified in post-incident analysis was Insufficient input validation within the PAN-OS CLI interface, Inadequate security controls for OAuth tokens in Salesloft Drift.Over-permissive third-party app integrations with Salesforce.Lack of real-time monitoring for anomalous token usage., Improper checks for unusual conditions (CWE-754)Pointer manipulation vulnerability (CAPEC-129)Lack of input validation in data plane packet handling, Improper input neutralization in GlobalProtect Captive Portal web page generation.Lack of default protections against reflected XSS in Clientless VPN configurations..

Most Significant Corrective Action: The most significant corrective action taken based on post-incident analysis was Patching and restricting administrative access, Disabled vulnerable integrations (Palo Alto Networks).Revoked compromised OAuth tokens.Enhanced authentication protocols (Zscaler).Third-party risk management investigations launched., Code fixes in patched PAN-OS versions to validate data plane inputsEnhanced testing for DoS resilience in firewall softwareProactive hotfix distribution for critical vulnerabilities, Code-level fixes in upcoming PAN-OS patches.Enhanced Threat Prevention signatures for XSS detection..