Deja Vu: Salesforce Customers Hacked Again, Via Gainsight

Deja Vu: Salesforce Customers Hacked Again, Via Gainsight reports that threat actors linked to the ShinyHunters extortion group breached Salesforce instances again by exploiting a third‑party integration, after a spring vishing campaign targeting Salesforce environments.

The attackers conducted a supply‑chain breach through Salesloft’s Drift, stole OAuth tokens linking Drift and Salesforce, and used them to access hundreds of organisations’ Salesforce environments, including Gainsight, which disclosed in a security alert that attackers accessed its Drift instance and the associated business data.

Google Threat Intelligence Group has publicly attributed the attack to hackers tied to ShinyHunters, and DataBreaches[.]net states that the group gained access to Salesforce data for nearly 1,000 organisations, with more than 200 customer instances impacted. Salesforce’s response included revoking all active access and refresh tokens for apps published with Gainsight and temporarily removing those apps from its AppExchange marketplace.

The article notes that Salesforce emphasised there was no indication of a Salesforce platform vulnerability, and that the activity appeared related to the app’s external connection to Salesforce. November 21, 2025.