Salesforce says some of its customers’ data was accessed after Gainsight breach

Salesforce mentioned on Wednesday that it’s investigating a breach of “sure prospects’ Salesforce information” that was compromised via apps revealed by Gainsight, an organization that sells a platform for different corporations to handle their prospects. 

In a notice published late Wednesday, Salesforce mentioned the hacks contain “Gainsight-published functions linked to Salesforce, that are put in and managed straight by prospects.” 

Salesforce mentioned that there’s “no indication that this difficulty resulted from any vulnerability within the Salesforce platform,” and that the exercise seems associated to Gainsight’s “exterior connection to Salesforce.”

When reached for remark, Salesforce spokesperson Nicole Aranda referred TechCrunch to the corporate’s web page devoted to the incident. 

As of this writing, Gainsight mentioned in a status page that it’s investigating a “Salesforce connection difficulty,” with out making any reference to a possible breach. “Our inner investigation is ongoing,” Gainsight wrote.

A spokesperson for Gainsight didn’t instantly reply to TechCrunch’s request for remark.

On its web site, Gainsight touts a number of company prospects, together with Airtable, Notion, GitLab, and others. When reached by e mail, GitLab spokesperson Emily James informed TechCrunch that the Gitlab’s “safety group is investigating and we’ll get again to you when we’ve extra to share.”

The prolific hacking group ShinyHunters told cybersecurity news website DataBreaches.net that it was behind the breach, including that if Salesforce doesn’t negotiate with them, they’ll create a brand new web site to promote the stolen information — a typical extortion tactic by financially-motivated cybercriminals. 

“The subsequent [data leak site] will include the information of the Salesloft and GainSight campaigns,” the hackers informed DataBreaches.web. The hackers declare to have stolen information from near a thousand corporations.

This information breach seems much like an August breach at AI marketing chatbot maker Salesloft, which allowed the hackers to interrupt into quite a lot of their prospects’ linked Salesforce cases to steal delicate information, comparable to entry tokens for different companies. Among the many victims included insurance coverage big Allianz Life, Bugcrowd, Cloudflare, Google, vogue conglomerate Kering, Proofpoint, the airline Qantas, carmaker Stellantis, credit score bureau TransUnion, the worker administration platform Workday, and others. 

Within the case of the Salesloft breaches, the hacking group Scattered Lapsus$ Hunters, which apparently contains the ShinyHunters gang, claimed responsibility. 

Final month, the hackers launched a dedicated website to extort the victims of the breaches, the place they threatened to launch a billion data. 

On the time, Gainsight confirmed it was among the many victims of the Salesloft-linked breaches, however it’s unclear if this new wave of hacks originated from its earlier compromise.