gainsight tokens opened a side door into salesforce orgs
Compromised tokens tied to Gainsight's Salesforce connected app gave attackers access to some customers' Salesforce data, and the integrations stayed offline for weeks.
- affected
- a subset of Salesforce orgs connected to Gainsight-published apps (notified by Salesforce)
- platforms
- Salesforce via Gainsight Connected App (OAuth); HubSpot, Zendesk and Gong.io connectors made inactive by those vendors
what happened
- On the afternoon of 2025-11-19 Salesforce notified Gainsight of unusual activity involving the Gainsight Salesforce Connected App and flagged a small number of customer orgs with suspicious access attempts, initially three.[1]
- The suspicious activity was API calls made through the Gainsight Connected App from non-whitelisted IP addresses.[1,5]
- Gainsight's status page said Salesforce temporarily revoked active access tokens for Gainsight-connected apps as a precaution; The Hacker News reported that Salesforce revoked all active access and refresh tokens, temporarily removed the apps from AppExchange and said there was no indication of a vulnerability in the Salesforce platform.[2,4]
- As a precaution, Gong.io, Zendesk and HubSpot made their connectors to Gainsight inactive.[1]
- Gainsight's CEO wrote on 2025-11-25 that Salesforce had identified compromised customer tokens and that Gainsight "presently know[s] of only a handful of customers who had their data affected."[3]
- On 2025-11-27 Gainsight told customers to rotate all S3 and connector credentials, including BigQuery, Zuora and Snowflake; on 2025-12-08 it said Mandiant and CrowdStrike had completed their independent investigations.[2]
- Salesforce approved the Gainsight managed package and connected apps on 2025-12-10, and Gainsight marked the incident resolved on 2026-03-18.[2]
where sources differNo final count of affected orgs appears in the cited sources: Salesforce first flagged three, then sent an expanded list on 2025-11-21, and Gainsight's CEO described a handful of customers with data affected. ShinyHunters' claims, reported by The Hacker News and Help Net Security, are unverified and left out.
sources5
- 01Salesforce Security Advisory FAQs Archive - November 22nd Updates and Prior ↗ primaryGainsightaccessed 2026-10-21
- 02Salesforce Connection Restoration (incident) ↗ primaryGainsight Statusaccessed 2026-10-21
- 03Supporting our customers and community: an update on the recent security advisory related to Gainsight ↗ primaryGainsightaccessed 2026-10-21
- 04Salesforce flags unauthorized data access via Gainsight-published apps ↗ secondaryThe Hacker Newsaccessed 2026-10-21
- 05Salesforce Gainsight compromise: Early findings and customer guidance ↗ secondaryHelp Net Securityaccessed 2026-10-21