Threat actors have reportedly launched yet another campaign involving an application connected to Salesforce

Salesforce says there was unusual activity involving Gainsight-published applications connected to Salesforce, which could have allowed unauthorized access to customer data through the app’s connection. According to Salesforce, they revoked all active access and refresh tokens for those apps and temporarily removed them from the AppExchange while the investigation continues, with no indication that the Salesforce platform itself was vulnerable.

DataBreaches[.]Net notes that, given Salesforce’s history of targeting by ShinyHunters and its associates, the site asked ShinyHunters whether the Gainsight campaign was theirs; the spokesperson indicated that it was, calling it “unfortunately” the third or fourth large-scale campaign against Salesforce by the same group.

The spokesperson also said they plan to launch another dedicated leak site if Salesforce does not comply, stating the next DLS will contain data from the Salesloft and GainSight campaigns, affecting almost 1000 organisations, mainly Fortune 500 companies such as Verizon, GitLab, F5 and SonicWall. Salesforce has notified known affected customers directly and will provide updates as appropriate, according to the security advisory posted on 19 November 2025 at 10:57 pm EST.