ShinyHunters Claims Gainsight Breach via Salesloft Drift Access

First seen 23 Nov 2025, 12:26 UTC • Theregister

•41

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

ShinyHunters has taken responsibility for a breach of Gainsight, impacting hundreds of Salesforce customers. The group stated they accessed Gainsight through vulnerabilities exploited during the Salesloft Drift hack earlier this year, claiming to have had access for nearly three months.

How this analysis works

Attack Flow

12 entities, 17 inferred relationships (STIX 2.1).

Threat Actor (2)

ShinyHunters
Unc6240

Technique (1)

Data Breach

Campaign (1)

Drift

Organization (5)

Gainsight
Hubspot
Salesforce
Zendesk
AWS

Affected Platform (2)

AppExchange
GitHub

Tool (1)

Salesloft

Relationships

ShinyHunters uses Salesloft
Unc6240 uses Salesloft
ShinyHunters uses Data Breach
Unc6240 uses Data Breach
Drift attributed to ShinyHunters
Drift attributed to Unc6240
ShinyHunters targets Gainsight
ShinyHunters targets Hubspot
ShinyHunters targets Salesforce
ShinyHunters targets Zendesk
Unc6240 targets Gainsight
Unc6240 targets Hubspot
Unc6240 targets Salesforce
Unc6240 targets Zendesk
ShinyHunters related to AWS
ShinyHunters related to AppExchange
ShinyHunters related to GitHub

Continue Reading

Critical RCE Vulnerability in Oracle PeopleSoft Exploited by SHADOW-AETHER-015 ShinyHunters Exploits Oracle PeopleSoft Zero-Day Vulnerability Coordinated Cyberattack Disrupts Water Utilities in Minnesota 2026 Cyberattacks Target Critical Infrastructure and Data Breaches Critical Vulnerabilities and Exploits Targeting Cisco, Canvas, and Microsoft Systems LVMH Brands Fined 36 Billion Won for Salesforce Data Breaches

ShinyHunters Claims Gainsight Breach via Salesloft Drift Access

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading