Data was exfiltrated from Palo Alto Networks' Salesforce instances, consisting largely of customer contact and account details. Allegedly, the attacker used automated Python tools for the attack, covering their tracks through deleting query logs.