InfoSecBulletin Cybersecurity for mankind
Salesforce said on Wednesday that it’s investigating a breach of “certain customers’ Salesforce data” that was compromised through apps published by Gainsight, a company that sells a platform for other companies to manage their customers.
In a notice published late Wednesday, Salesforce said the hacks involve “Gainsight-published applications connected to Salesforce, which are installed and managed directly by customers.”
Ransomware Crisis in 2026: 5,064 Organizations Affected in 135 Countries
Palo Alto Networks Addresses 13 Vulnerabilities
Critical Dell BIOS & Zimbra Flaws Expose Enterprise Systems
CoLoCity Launches New 1.0 MW Data Center Facility at Gulshan
Daily Cyber security update for 10. 07. 2026
How Hacker Compromise AWS Cloud Environment Using AI in 72 Hours
Mycelium Framework: First AI-as-a-Service Botnet
CrowdStrike Shows 5 New Prompt Injection Techniques for AI Agents
Critical GCP Dialogflow Vulnerability Allows Malicious Code Injection
CIRT identified 153 publicly exposed FortiGate devices in Bangladesh
Salesforce said that there is “no indication that this issue resulted from any vulnerability in the Salesforce platform,” and that the activity appears related to Gainsight’s “external connection to Salesforce.”
Gainsight said in a status page that it is investigating a “Salesforce connection issue,” without making any reference to a potential breach. “Our internal investigation is ongoing,” Gainsight wrote.
ShinyHunters told DataBreaches.net that it was behind the breach, adding that if Salesforce doesn’t negotiate with them, they will create a new website to advertise the stolen data — a common extortion tactic by financially-motivated cybercriminals.
“The next [data leak site] will contain the data of the Salesloft and GainSight campaigns,” the hackers told DataBreaches.net. The hackers claim to have stolen data from close to a thousand companies.
In the case of the Salesloft breaches, the hacking group Scattered Lapsus$ Hunters, which apparently includes the ShinyHunters gang, claimed responsibility.
In a statement to TechCrunch, CrowdStrike spokesperson Kevin Benacci noted that the company is “not affected by the Gainsight issue and all customer data remains secure.”
However, CrowdStrike confirmed that it dismissed a “suspicious insider” who allegedly shared information with hackers.
Verizon spokesperson Kevin Israel said that the company “is aware of the unsubstantiated claim by the threat actor,” but did not provide evidence to support the claim.
Malwarebytes spokesperson Ashley Stewart added that the company’s security team is “aware” of the Gainsight and Salesforce issues and is “actively investigating the matter.”
Meanwhile, Michael Adams, chief information security officer at DocuSign, highlighted that through “comprehensive log analysis and internal investigation, we have no indication of Docusign data compromise at this time.”
Adams also noted that “out of an abundance of caution, we have taken a number of measures including terminating all Gainsight integrations and containing related data flows.”
Salesforce spokesperson Nicole Aranda said that “as a matter of policy, Salesforce does not comment on specific customer issues.”
