ZenBusiness Data Breach Analysis | FemtoSec | Femto Security Threat Intelligence

Key Takeaways

The breach of ZenBusiness compromised over one million customer records, physical addresses, business parameters, and tax registration identifiers.
The attack did not rely on software vulnerabilities, but used targeted vishing and OAuth 2.0 Device Flow hijacking to steal valid admin tokens.
The threat group moved laterally from Salesforce into Snowflake and Mixpanel using active keys found in the integrated CRM environment.
Phishing-resistant multi-factor authentication (MFA) and strict API white-listing are essential to stop cloud application trust exploitation.

Original source screenshot for Analyzing the ZenBusiness Customer Data Leak — Original source screenshot - pwnforums.st

ZenBusiness Data Leak - Severity Profile

High-risk SaaS lateral movement resulting in the exposure of over one million business records.

0.0

/ 10.0 custom

High

Breach Impact Metrics

Compromised Records

0M+

Targeted SaaS Platforms

Unique Email Accounts Exposed

SaaS-to-SaaS Lateral Movement Flow

11. Voice Phishingmedium
Attacker impersonates IT helpdesk to manipulate target admin
medium
22. OAuth Abusehigh
Attacker requests OAuth Device Flow; admin enters 8-char code on Salesforce portal
high
33. Token Hijackcritical
Rogue app is authorized, issuing valid access & refresh tokens that bypass MFA
critical
44. Lateral Crawlcritical
Automated scripts search CRM database, extracting keys for Snowflake & Mixpanel
critical
55. Exfiltrationcritical
Bulk customer directories, tax IDs, and analytics records exfiltrated
critical

Adversary MITRE ATT&CK Mapping

Initial Access

T1566.004

Phishing: Voice Phishing

Credential Access

T1528

Steal Application Access Token

Lateral Movement

T1671

Cloud Application Integration

Collection

T1213.004

Data from Information Repositories

Exfiltration

T1020

Automated Exfiltration

How to Defend Against Similar Threats

Revoke all unapproved or newly integrated connected apps and refresh tokens in your enterprise CRM systems.
Transition administrators and IT helpdesk personnel to phishing-resistant security keys like FIDO2/WebAuthn.
Restrict Salesforce, Snowflake, and Mixpanel API access to authorized corporate IP egress blocks.
Run an external integration audit to ensure third-party configuration secrets are not exposed to basic users.

Threat Intel FAQ

How did attackers access the ZenBusiness customer database?

Rather than exploiting software bugs, the threat actors used voice phishing (vishing) to trick administrators into approving a connected application through the OAuth 2.0 Device Flow. This granted the attackers high-privilege access and refresh tokens, allowing them to systematically extract database records from Salesforce and connected cloud platforms like Snowflake.

What information was exposed in the ZenBusiness breach?

The leaked dataset includes approximately one million records containing physical addresses, organizational email addresses, tax and employer identification numbers (EINs), names, and other business registration details.

Could a similar threat affect your organization?

If your team may be exposed to a similar threat, FemtoSec can help validate blast radius, prioritize remediation, and connect the issue to a practical security program.

Analyzing the ZenBusiness Customer Data Leak

Key Takeaways

How to Defend Against Similar Threats

Threat Intel FAQ

Could a similar threat affect your organization?