Gainsight-published Salesforce app tokens abused against customer instances
Salesforce disclosed on November 19, 2025 suspicious activity involving Gainsight-published applications connected to Salesforce, revoked all their active access and refresh tokens, and pulled the apps from AppExchange. Google Threat Intelligence said it was aware of more than 200 potentially affected Salesforce instances, and reporting tied the activity to ShinyHunters and to tokens taken in the earlier Salesloft Drift campaign.
- Victim
- Multiple: Salesforce customers using Gainsight-published apps
- Industry
- B2B SaaS
- Country
- Global
- Intrusion began
- Not disclosed
- First disclosed
- Nov 19, 2025
- Actor
- ShinyHunters (claimed; linked by Google Threat Intelligence, per press) (Extortion group)
- Initial access
- OAuth token abuse
- Identity control that failed
- Non-human identity
- MFA
- Not applicable (no interactive login)
- Abused identity
- Non-human (service account, token, key or app)
- Records affected
- Not disclosed
- Disclosed cost
- Not disclosed
The identity lesson
It was the second time in three months that a SaaS integration's OAuth tokens opened customer CRMs. Treat every connected app as a privileged non-human identity: minimal scopes, IP restrictions, short token lifetimes and monitoring for bulk API queries.
Go deeper on SWI
- Technique: Refresh token abuse
Sources
- Salesforce flags another third-party security incident, The Register, Nov 20, 2025
- Hundreds of Salesforce customers hit by yet another third-party vendor breach, CyberScoop, Nov 20, 2025
Record verified Oct 31, 2026 against the sources above. Corrections: contact us.
Related incidents
- Salesloft Drift OAuth tokens used to raid Salesforce tenants 2025 · OAuth token abuse
- GitHub private repositories accessed with stolen Heroku and Travis CI OAuth tokens 2022 · OAuth token abuse
- Malwarebytes email access via abused Microsoft 365 application 2021 · OAuth token abuse
- CrowdSec private repositories copied with a departing engineer's GitHub token 2026 · OAuth token abuse
Cite this record
SWI Community Team. (2026). Gainsight-published Salesforce app tokens abused against customer instances. Identity Breach Database, Start with Identity. https://startwithidentity.com/breaches/incidents/2025-gainsight-salesforce-token-abuse/
Part of the Identity Breach Database, free to reuse under CC BY 4.0. Analysis across every record: Identity Breach Report 2026.