Salesforce alerts users to potential data exposure via Gainsight OAuth apps

Salesforce warns that unusual activity in Gainsight-linked OAuth apps may have enabled unauthorized access to some customers’ Salesforce data. The company revoked all Gainsight app tokens and removed the apps from AppExchange after detecting suspicious external activity, and Salesforce confirmed that no platform flaw was found.

The notification states that the activity is tied to the app’s external connection to Salesforce and that Salesforce revoked all active access and refresh tokens associated with Gainsight-published applications connected to Salesforce. Affected customers were notified, and users who need support can contact Salesforce Help.

According to Google GTIG, the new campaign is linked to ShinyHunters, the same group that hit Salesloft Drift in August, with DataBreaches[.]Net reporting that ShinyHunters has claimed both waves and that nearly 1,000 organisations were affected in total. Gainsight also fell victim in an earlier Salesloft breach, though its connection to the current incident remains unclear.