Salesforce stated on Wednesday that it’s investigating a breach of “sure clients’ Salesforce knowledge” that was compromised by way of apps revealed by Gainsight, an organization that sells a platform for different corporations to handle their clients.
In a discover revealed late Wednesday, Salesforce stated the hacks contain “Gainsight-published functions related to Salesforce, that are put in and managed straight by clients.”
Salesforce stated that there’s “no indication that this challenge resulted from any vulnerability within the Salesforce platform,” and that the exercise seems associated to Gainsight’s “exterior connection to Salesforce.”
When reached for remark, Salesforce spokesperson Nicole Aranda referred information.killnetswitch to the corporate’s web page devoted to the incident.
Contact Us
Do you might have extra details about these Salesforce and Gainsight data breaches? Or different data breaches? From a non-work system, you’ll be able to contact Lorenzo Franceschi-Bicchierai securely on Sign at +1 917 257 1382, or by way of Telegram and Keybase @lorenzofb, or electronic mail. You can also contact information.killnetswitch by way of SecureDrop.
As of this writing, Gainsight stated in a standing web page that it’s investigating a “Salesforce connection challenge,” with out making any reference to a possible breach. “Our inside investigation is ongoing,” Gainsight wrote.
A spokesperson for Gainsight didn’t instantly reply to information.killnetswitch’s request for remark.
On its web site, Gainsight touts a number of company clients, together with Airtable, Notion, GitLab, and others. When reached by electronic mail, GitLab spokesperson Emily James advised information.killnetswitch that the Gitlab’s “security crew is investigating and we’ll get again to you when we’ve got extra to share.”
Techcrunch occasion
San Francisco
|
October 13-15, 2026
The prolific hacking group ShinyHunters advised cybersecurity information web site DataBreaches.internet that it was behind the breach, including that if Salesforce doesn’t negotiate with them, they are going to create a brand new web site to promote the stolen knowledge — a typical extortion tactic by financially-motivated cybercriminals.
“The subsequent [data leak site] will include the information of the Salesloft and GainSight campaigns,” the hackers advised DataBreaches.internet. The hackers declare to have stolen knowledge from near a thousand corporations.
This data breach seems just like an August breach at AI advertising chatbot maker Salesloft, which allowed the hackers to interrupt into numerous their clients’ related Salesforce cases to steal delicate knowledge, equivalent to entry tokens for different providers. Among the many victims included insurance coverage large Allianz Life, Bugcrowd, Cloudflare, Google, style conglomerate Kering, Proofpoint, the airline Qantas, carmaker Stellantis, credit score bureau TransUnion, the worker administration platform Workday, and others.
Within the case of the Salesloft breaches, the hacking group Scattered Lapsus$ Hunters, which apparently consists of the ShinyHunters gang, claimed duty.
Final month, the hackers launched a devoted web site to extort the victims of the breaches, the place they threatened to launch a billion information.
On the time, Gainsight confirmed it was among the many victims of the Salesloft-linked breaches, nevertheless it’s unclear if this new wave of hacks originated from its earlier compromise.
