Breach of Gainsight-connected apps leads to unauthorized access to Salesforce customer data
Unauthorized access to some Salesforce customer data occurred through a breach of Gainsight-connected apps. The related tokens were revoked, distribution of the apps was suspended, and Salesforce investigated the damage. ShinyHunters claimed to have accessed 285 Salesforce environments, but the actual extent of the damage has not been confirmed.
Key facts
- Affected organization
- Salesforce
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Unauthorized access to some customer data; actual extent of damage under investigation
- Cause / method
- Compromise of OAuth tokens of Gainsight-connected apps
- Location
- Other countries
If your data was exposed
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organization’s official website or app.
Timeline
- Salesforce said unauthorized access to some customer data occurred following the Gainsight breach.
- The related tokens were revoked and app distribution was suspended, while ShinyHunters claimed to have accessed 285 Salesforce environments.
7 related reports
- Salesforce says some of its customers’ data was accessed after Gainsight breach
- Salesforce investigates customer data theft via Gainsight breach
- ShinyHunters Hack Salesforce Instances Via Gainsight Apps
- Salesforce Instances Hacked via Gainsight Integrations
- Hackers Claim New Mega Breach As Salesforce Investigates Data Thefts
- OAuth token compromise hits Salesforce ecosystem again, Gainsight impacted
- Deja Vu: Salesforce Customers Hacked Again, Via Gainsight
Other incidents at Salesforce
Millions of records leaked after data theft from Salesforce customers
Impact: Data stolen from dozens of customers and millions of records released
Attackers stole data from dozens of Salesforce customers and used it to demand money. The attackers claimed to have obtained more than about 1 billion records, and Salesforce refused to pay. Even after the FBI's takedown, the attack group released millions of records.
Related reports: 11 · last report →Domains used in Salesforce breach attacks taken down
A series of breach attacks targeting Salesforce took place. The FBI shared related indicators of compromise, and domains used by ShinyHunters to hack Salesforce were later taken down.
Related reports: 3 · last report →Data theft attacks targeting Salesforce customers spread
↳ Knock-on damage from the Salesloft incident · View original incident1.5BImpact: Hundreds of customers affected; attackers claim theft of 1.5 billion records
Data theft attacks targeting Salesforce customers continued, with several companies including Google confirming they were affected. The attacks involved voice phishing and the abuse of stolen OAuth tokens from Salesloft Drift. Drift was taken offline, and ShinyHunters claimed to have stolen 1.5 billion records through the Drift hack.
Related reports: 15 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organization’s official statements for accurate details.