Salesforce / Gainsight OAuth-token incident — potential customer-data exposure

[Eyal Estrin]

Salesforce says some of its customers’ data was accessed after Gainsight breach
https://techcrunch.com/2025/11/20/salesforce-says-some-of-its-customers-data-was-accessed-after-gainsight-breach/

Security Advisory: Unusual Activity related to the Gainsight application
https://help.salesforce.com/s/articleView?id=005229029&type=1

Deja Vu: Salesforce Customers Hacked Again, Via Gainsight
https://www.darkreading.com/cyberattacks-data-breaches/salesforce-customers-hacked-gainsight

OAuth token compromise hits Salesforce ecosystem again, Gainsight impacted
https://www.csoonline.com/article/4094506/oauth-token-compromise-hits-salesforce-ecosystem-again-gainsight-impacted.html

Salesforce Flags Unauthorized Data Access via Gainsight-Linked OAuth Activity
https://thehackernews.com/2025/11/salesforce-flags-unauthorized-data.html

Eyal Estrin

CISSP, CCSP, CISM, CISA, CDPSE, CCSK

Blog: https://security-24-7.com | Books: https://amzn.to/42Xai9A | https://amzn.to/3Sggbtv

Twitter: @eyalestrin | Bluesky: @eyalestrin.bsky.social