Salesforce Flags Unauthorized Data Access via Gainsight-Linked OAuth Activity

Salesforce has warned of unusual activity tied to Gainsight-published applications connected to the platform, with the company saying the investigation suggests the activity may have enabled unauthorized access to certain customers’ Salesforce data via the app’s connection. In response, Salesforce has revoked all active access and refresh tokens for Gainsight-connected apps and temporarily removed those applications from the AppExchange while the probe continues.

The firm did not disclose how many customers were affected, but it said it has notified them. Salesforce added there is no indication the issue stemmed from a Salesforce platform vulnerability and noted the activity appears related to the app’s external connection to Salesforce. Gainsight has pulled the affected app from the HubSpot Marketplace as a precaution, which could impact OAuth access for some customer connections during the review.

The incident is being linked by some researchers to threat actors associated with the ShinyHunters group, with DataBreaches[.]Net indicating the campaign involved nearly 1,000 organisations and was claimed by ShinyHunters as theirs.