Story perspectives

Salesforce Data Breach: Gainsight Apps Linked to Cybercriminals

11/22/2025

Summary

Story summary

Salesforce reported a data breach linked to Gainsight applications, with unusual activity potentially exposing customer data.
Google Threat Intelligence identified over 200 potentially affected Salesforce instances.
The breach is believed linked to the ShinyHunters cybercriminal group, which previously exploited vulnerabilities in Salesloft Drift.
Salesforce revoked access to Gainsight applications and is investigating the incident, while Gainsight collaborates with Salesforce and has removed its app from HubSpot Marketplace as a precaution.

History

Historical Context

The ShinyHunters cybercriminal group emerged in 2020, gaining notoriety for breaching major companies like Tokopedia and Microsoft, compromising millions of records. By 2025, they were linked to significant data theft campaigns, including a breach affecting Salesforce, which involved over 1.5 billion records from 760 companies. This highlights ongoing vulnerabilities in data security and the escalating threat of cybercrime.

1 of 2

Story summary

Salesforce reported a data breach linked to Gainsight applications, with unusual activity potentially exposing customer data.
Google Threat Intelligence identified over 200 potentially affected Salesforce instances.
The breach is believed linked to the ShinyHunters cybercriminal group, which previously exploited vulnerabilities in Salesloft Drift.
Salesforce revoked access to Gainsight applications and is investigating the incident, while Gainsight collaborates with Salesforce and has removed its app from HubSpot Marketplace as a precaution.

1 / 2