Salesforce security incident history
Hacking, data breaches and other security incidents involving Salesforce, with related coverage.
Breach of Gainsight-connected apps leads to unauthorised access to Salesforce customer data
Impact: Unauthorised access to some customer data; actual extent of damage under investigation
Unauthorised access to some Salesforce customer data occurred through a breach of Gainsight-connected apps. The related tokens were revoked, distribution of the apps was suspended, and Salesforce investigated the damage. ShinyHunters claimed to have accessed 285 Salesforce environments, but the actual extent of the damage has not been confirmed.
Related reports: 7 · last report →Millions of records leaked after data theft from Salesforce customers
Impact: Data stolen from dozens of customers and millions of records released
Attackers stole data from dozens of Salesforce customers and used it to demand money. The attackers claimed to have obtained more than about 1 billion records, and Salesforce refused to pay. Even after the FBI's takedown, the attack group released millions of records.
Related reports: 11 · last report →Domains used in Salesforce breach attacks taken down
A series of breach attacks targeting Salesforce took place. The FBI shared related indicators of compromise, and domains used by ShinyHunters to hack Salesforce were later taken down.
Related reports: 3 · last report →Data theft attacks targeting Salesforce customers spread
↳ Knock-on damage from the Salesloft incident · View original incident1.5bnImpact: Hundreds of customers affected; attackers claim theft of 1.5 billion records
Data theft attacks targeting Salesforce customers continued, with several companies including Google confirming they were affected. The attacks involved voice phishing and the abuse of stolen OAuth tokens from Salesloft Drift. Drift was taken offline, and ShinyHunters claimed to have stolen 1.5 billion records through the Drift hack.
Related reports: 15 · last report →