Domains used in Salesforce breach attacks taken down
A series of breach attacks targeting Salesforce took place. The FBI shared related indicators of compromise, and domains used by ShinyHunters to hack Salesforce were later taken down.
Key facts
- Affected organisation
- Salesforce
- Incident type
- Hacking & intrusion
- Occurred / detected
- Not confirmed
- Scale of damage
- Not confirmed
- Cause / method
- Not confirmed
- Location
- Other countries
Timeline
- The FBI shared indicators of compromise related to recent Salesforce breach attacks.
- An FBI crackdown took down domains used by ShinyHunters to hack Salesforce.
Also affected by this incident
Stellantis third-party service provider breach leaks North American customer contacts
↳ Knock-on damage from the Salesforce incident · View original incidentImpact: North American customer contact information leaked
Stellantis confirmed that North American customer information had been leaked through a breach at a third-party service provider. The leaked information included customer contact details. The incident was reported to be linked to the Salesforce hacks.
Related reports: 7 · last report →
3 related reports
Other incidents at Salesforce
Breach of Gainsight-connected apps leads to unauthorised access to Salesforce customer data
Impact: Unauthorised access to some customer data; actual extent of damage under investigation
Unauthorised access to some Salesforce customer data occurred through a breach of Gainsight-connected apps. The related tokens were revoked, distribution of the apps was suspended, and Salesforce investigated the damage. ShinyHunters claimed to have accessed 285 Salesforce environments, but the actual extent of the damage has not been confirmed.
Related reports: 7 · last report →Millions of records leaked after data theft from Salesforce customers
Impact: Data stolen from dozens of customers and millions of records released
Attackers stole data from dozens of Salesforce customers and used it to demand money. The attackers claimed to have obtained more than about 1 billion records, and Salesforce refused to pay. Even after the FBI's takedown, the attack group released millions of records.
Related reports: 11 · last report →Data theft attacks targeting Salesforce customers spread
↳ Knock-on damage from the Salesloft incident · View original incident1.5bnImpact: Hundreds of customers affected; attackers claim theft of 1.5 billion records
Data theft attacks targeting Salesforce customers continued, with several companies including Google confirming they were affected. The attacks involved voice phishing and the abuse of stolen OAuth tokens from Salesloft Drift. Drift was taken offline, and ShinyHunters claimed to have stolen 1.5 billion records through the Drift hack.
Related reports: 15 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.