Back Scworld

Gainsight compromise facilitated by Salesloft Drift hack, alleges ShinyHunters

Scworld • November 24, 2025

Threat operation ShinyHunters asserts having compromised software firm Gainsight nearly three months ago following the sweeping Salesloft Drift breach earlier this year, reports The Register .

Over 200 organizations using Salesforce were reported by the Google Threat Intelligence Group to have been potentially impacted by the breach of Gainsight-connected apps, which ShinyHunters claims to have stemmed from Salesloft's GitHub account.

"The data from Salesloft Drift breached has enabled entry points into so many systems. Very lucrative systems. I do not like Salesforce at all, would be nice if they stopped acting all high and mighty and just pay to fix this mess," said a purported ShinyHunters member.

Such a development comes after Salesforce quashed all active access and refresh tokens linked to Gainsight apps. Similar connector access revocation has been conducted by Zendesk in the wake of the intrusion. Salesforce had stressed its refusal to fulfill the ransom demands of ShinyHunters.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Data Breach Affects Over 200 Companies via Gainsight Integration with Salesforce Hackers compromised Salesforce-stored data from more than 200 companies through a supply chain attack involving Gainsight applications. Google confirmed the breach, stating that unauthorized access to customer data was facilitated by the exploitation of OAuth tokens. Salesforce is actively investigating the incident and has revoked access to the affected applications. 44 sources 36

Extracted Entities

Gainsight compromise facilitated by Salesloft Drift hack, alleges ShinyHunters

The full story

Extracted Entities

APT Groups (1)

Attack Types (1)

Companies (3)

Platforms (1)

Tools (1)