The November 2025 Salesforce incident was not evidence of a vulnerability in Salesforce’s core platform. It involved the Gainsight Salesforce connected application and older OAuth tokens that attackers used to call Salesforce APIs in customer environments. Google Threat Intelligence Group told CyberScoop that more than 200 Salesforce instances were potentially affected, while Gainsight said only a small number of customers were known to have had data affected.
Salesforce revoked the relevant OAuth tokens and disabled the Gainsight connection on November 20, 2025. After remediation was independently validated by Mandiant and CrowdStrike, Salesforce re-enabled the integration on December 10, 2025.
As an Amazon Associate I earn from qualifying purchases.
The short version
- What was involved: Gainsight’s Salesforce connected applications and OAuth tokens issued for that integration.
- What Salesforce said: There was no indication that the incident resulted from a vulnerability in the Salesforce platform.
- Potential scope: More than 200 Salesforce instances, according to Google Threat Intelligence Group reporting cited by CyberScoop.
- Confirmed impact: Gainsight said it knew of only a handful of customers whose data was affected. That is not the same population as potentially exposed instances.
- Status: Salesforce disabled the connection and revoked associated tokens on November 20, 2025, then restored the integration on December 10 after remediation and validation.
What happened?
Salesforce detected unusual API activity associated with Gainsight-published applications. The requests used valid OAuth tokens issued for the Gainsight-Salesforce connector, but came from infrastructure or IP addresses that Salesforce did not associate with Gainsight’s normal applications.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Salesforce responded by revoking active and refresh tokens associated with the application and temporarily disabling the connection. Gainsight engaged Mandiant and CrowdStrike to investigate and remediate the incident.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Gainsight’s later technical explanation said attackers had obtained a set of older Salesforce OAuth tokens. They reportedly tested approximately 250 tokens on October 22, 2025, to determine which remained active, then used validated tokens to make Salesforce API calls between November 16 and 19.
On November 20, Mandiant received a file containing 285 Salesforce OAuth tokens from individuals claiming to be threat actors. Gainsight said the tokens dated from October 2017 through August 2023. By late November 2025, only about 23% of those tokens were still present in Gainsight systems.
The key point is that a valid application token can authorize API activity without an attacker signing in interactively as each customer. The attack path therefore ran through a trusted integration rather than a newly discovered flaw in Salesforce’s own software.
See the Salesforce security advisory for Salesforce’s account of the token revocation, temporary shutdown, and restoration.
Was Salesforce itself hacked?
There is no cited evidence that Salesforce’s platform was breached through a Salesforce software vulnerability. Salesforce explicitly said there was no indication that the issue resulted from a vulnerability in the Salesforce platform.
Calling this simply “a Salesforce breach” is therefore misleading. More precise descriptions are:
- a Salesforce-connected application incident;
- an OAuth-token abuse campaign affecting Salesforce environments; or
- a third-party integration supply-chain incident.
The distinction matters. Salesforce customers can have their data accessed through an authorized application even when the underlying SaaS platform has not been compromised. The application’s permissions and tokens become the practical access path.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
How many customers were affected?
The public figures describe different stages of exposure, so they should not be treated as competing estimates of confirmed data theft.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
| Population or measure | What the public evidence shows |
|---|---|
| Potentially affected Salesforce instances | More than 200, according to Google Threat Intelligence Group reporting cited by CyberScoop. |
| Tokens in the file sent to Mandiant | 285 Salesforce OAuth tokens, according to Gainsight. |
| Tokens reportedly validated by attackers | Approximately 250, according to Gainsight’s later technical explanation. |
| Organizations initially identified | Three in Gainsight’s early incident timeline, before Salesforce expanded the notification list. |
| Customers known to have had data affected | A small number or “handful,” according to Gainsight’s November 25 customer update. |
These categories are not interchangeable. A Salesforce instance could have been associated with a token in the dataset without that token still being active. An active token could have been validated without evidence that an attacker read or exported customer data. An organization could have suspicious API activity without the public record establishing exactly what data was accessed.
The most defensible summary is therefore: more than 200 Salesforce environments were potentially implicated, but the number of customers with publicly confirmed data impact was much smaller. It is not accurate to say that hundreds of customers definitely had their data stolen.
Why OAuth tokens made this a one-to-many incident
OAuth lets a connected application call Salesforce APIs after a customer authorizes it. Depending on the permissions granted, the application may be able to read or write Salesforce records without requiring a fresh interactive login for every request.
Free tools Windows power users keep installed
One-click scans. No signup required.
That creates several security consequences:
- Tokens can outlive the original business need. They may remain usable until they expire, are rotated, or are revoked.
- Application access inherits customer approval. If an integration has broad permissions, a stolen token may provide access to a broad set of records.
- MFA is not a complete defense. MFA protects a human login flow; it does not necessarily invalidate an already-issued application token.
- Dormant integrations remain a risk. An integration may have no interactive users while still making scheduled API calls.
- One vendor can connect many customers. Reusing or compromising tokens associated with a widely deployed integration creates a downstream attack path across multiple Salesforce organizations.
Gainsight’s token-age analysis is particularly important. The dataset included tokens created as far back as 2017, with the newest reportedly created in August 2023. That evidence points toward the reuse of historical credentials, not necessarily a newly discovered compromise of Gainsight’s current production environment.
What data may have been accessed?
The public material does not establish one uniform dataset taken from all potentially affected organizations. Unauthorized access to certain customers’ Salesforce data may have occurred, but the available evidence does not support saying that a particular data type was stolen from every affected environment.
Depending on the permissions granted to the connected application, relevant Salesforce data could have included:
- leads and contacts;
- accounts and opportunities;
- customer-success or support information;
- notes, cases, and activity records; and
- custom objects, fields, reports, or exports available to the application.
These are possible categories, not a confirmed universal list. Each organization needs to review its own API and audit evidence to determine whether records were read, exported, changed, or deleted.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchDid Gainsight itself suffer a breach?
The answer requires qualification. Mandiant and CrowdStrike summaries commissioned by Gainsight said they found no evidence of an active threat actor in the investigated Gainsight application environments. Gainsight also said its available logs did not show that the leaked token set originated from its systems during the relevant logging period.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
That does not establish exactly where the tokens were first obtained. Gainsight said it could not determine the source of the leaked token set, and its technical explanation discussed historical periods in which some tokens may have existed in or around Gainsight-controlled environments.
The accurate formulation is: the investigations found no evidence of an active attacker in the investigated Gainsight environments, but the original source of the tokens was not conclusively identified. That is materially different from both “Gainsight was definitively breached” and “the incident had nothing to do with Gainsight.”
Gainsight’s public investigation summaries are available from Mandiant, CrowdStrike, and Gainsight’s technical explanation.
Timeline
| Date | Event |
|---|---|
| Approximately August 2023 | Gainsight said the newest token in the 285-token dataset was created around this time. |
| October 22, 2025 | Attackers reportedly validated approximately 250 tokens to identify those that remained active. |
| November 16–19, 2025 | Validated tokens were reportedly used to call Salesforce APIs against customer organizations. |
| November 19, 2025 | Salesforce notified Gainsight of unusual activity involving the Gainsight Salesforce Connected App. |
| November 20, 2025 | Salesforce disabled the connection and revoked associated OAuth tokens. Mandiant also received the 285-token file. |
| November 21, 2025 | Salesforce supplied Gainsight with an expanded list of affected customer organizations. |
| November 25, 2025 | Gainsight said only a handful of customers were known to have had data affected. |
| December 5, 2025 | Gainsight said the Mandiant investigation and remediation work had concluded. |
| December 7, 2025 | Gainsight said CrowdStrike had completed its investigation of specified ancillary application environments. |
| December 10, 2025 | Salesforce re-enabled Gainsight integrations after remediation and validation. |
The timeline is based on the Gainsight incident FAQ, the customer update, and the Salesforce advisory.
How this relates to the earlier Salesloft Drift incident
The Gainsight incident followed a separate 2025 campaign involving the Salesloft Drift integration and Salesforce customer environments. CyberScoop reported strong similarities between the events and said they may have involved the same broader threat cluster.
That should not be presented as proof of one conclusively established intrusion chain. The incidents should remain separate in reporting:
- Salesloft Drift: the earlier campaign, reported to have affected more than 700 customers.
- Gainsight: the later OAuth-token incident covered here.
- Attribution: similarities or researcher assessments are not the same as definitive public proof that the same attackers conducted both operations.
Gainsight’s security information says its products and services were not impacted by the Salesloft Drift incident, although its Salesforce CRM integration was involved in the broader campaign.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →What Salesforce administrators should do
1. Check whether Salesforce contacted your organization
Gainsight said Salesforce directly notified organizations on the expanded impact list. A lack of notification was not an absolute guarantee during the active investigation, but direct Salesforce notification was the primary customer-notification route described in the public FAQ.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
2. Preserve and review Salesforce evidence
Review API activity, Setup Audit Trail records, Event Monitoring data, and other available audit evidence. Salesforce said revoking Gainsight tokens did not delete historical audit trails, Setup Audit Trail entries, Event Monitoring logs, or API activity records.
Search specifically for activity associated with the Gainsight connected application and examine the reported November 16–19 activity window. Look for:
- unusual source IP addresses or locations;
- unexpected user agents;
- bulk reads or exports;
- access to sensitive objects or fields;
- unexpected record changes; and
- administrative or connected-app changes.
The dates are investigative leads, not proof that every affected organization experienced activity in that exact window.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minute3. Review and reduce connected-app permissions
Inventory every connected application, its owner, its business purpose, its scopes, and the Salesforce objects and fields it can access. Remove obsolete integrations and reduce permissions that exceed the application’s current requirements.
Pay particular attention to integrations approved years ago. A token’s age is not evidence that it is harmless; long-lived credentials are precisely what can remain useful after ownership and business processes have changed.
4. Revoke or rotate appropriate credentials
Rotate or revoke credentials for affected or unnecessary connected applications according to your continuity plan. Gainsight described rotating Salesforce, AWS S3, and Snowflake credentials and tokens as part of its remediation.
Revocation limits future use but cannot undo data that may already have been read or exported. Preserve evidence before making changes that could complicate an investigation, and coordinate with your incident-response team.
5. Check connected systems
Gainsight said other connector functionality, including Gong, Zendesk, and HubSpot connections, was temporarily affected as vendors took precautionary measures. That operational disruption does not itself prove those systems were compromised, but administrators should review downstream integrations, failed jobs, and authorization changes.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
6. Validate recovery after restoration
Once the integration is restored:
- Reauthorize the connector through the approved recovery path.
- Verify that the new managed package or connector version is trusted.
- Confirm that rules, reports, jobs, and synchronization processes resumed.
- Identify failed jobs and manually restart them where necessary.
- Compare Salesforce records and exports against known-good baselines.
- Preserve relevant logs before retention periods expire.
Gainsight said its recovery process was intended to preserve rules, reports, and connector configurations, but administrators were still expected to validate synchronization and manually retrigger assets that did not resume automatically. Its recovery guidance is available in the Gainsight FAQ.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What organizations should change after the incident
Govern OAuth tokens as non-human identities
Do not manage OAuth tokens as invisible implementation details. Assign an owner, record the business purpose, document the approved scopes, set an expiration or review date, and define a revocation process. Periodically identify tokens that have not been used or whose owning team no longer exists.
Use least privilege for connected applications
Grant only the objects, fields, and actions required by the integration. The trade-off is operational: customer-success platforms and other business systems may need broad synchronization access, and reducing scopes can break workflows. That is a reason to design and test least privilege carefully, not to skip it.
Monitor API activity, not just user logins
MFA and user-login alerts do not provide complete visibility into application-token misuse. Monitor connected-app events, API calls, anomalous source IPs, bulk exports, and unusual changes to non-human identities. Log collection is useful only if retention, alerting, ownership, and an investigation procedure are defined.
Review vendor controls before an incident
For every critical integration, ask:
- How are OAuth tokens stored?
- What is the maximum token lifetime?
- Are refresh tokens rotated?
- Can customers see token use by IP, application, and scope?
- What is the incident-notification SLA?
- Can the customer revoke access without disabling unrelated functions?
- Are subcontractors and downstream connectors included in incident scope?
- Will the vendor provide an independent forensic summary?
Common misconceptions
- “Salesforce was breached.” Too broad. The public evidence points to misuse of a connected application and OAuth tokens, not a Salesforce platform vulnerability.
- “More than 200 companies lost data.” Not established. More than 200 instances were described as potentially affected; Gainsight said only a handful were known to have data affected.
- “Token revocation proves the data was safe.” Revocation limits future access but does not reverse previous reads or exports.
- “MFA would have stopped the attack.” Not necessarily. The reported activity involved application tokens rather than fresh interactive human logins.
- “The tokens definitely came from Gainsight.” Gainsight said it could not identify their source and that investigators found no evidence in available logs that the tokens originated from its systems.
- “The incident ended when the connector was disabled.” Containment, forensic investigation, remediation, and restoration are separate stages.
- “A restored connector is automatically safe.” Restoration means remediation passed the stated validation process. Customers still need to audit their own Salesforce environments.
Where security products fit
The incident highlights a control problem that is broader than antivirus software: organizations need visibility into SaaS permissions, OAuth tokens, API activity, and third-party integrations.
Salesforce customers may evaluate Salesforce Security products, including Salesforce Shield and Event Monitoring, for Salesforce-native event visibility, audit controls, and related protections. Salesforce Identity is relevant to authentication, connected applications, and identity policies within the Salesforce ecosystem. These are generally enterprise-oriented capabilities, so current pricing and availability should be confirmed directly with Salesforce.
Organizations with many SaaS platforms may also assess SaaS security posture management providers such as AppOmni, Adaptive Shield, Obsidian Security, Grip Security, and Valence Security. Typical capabilities include connected-app discovery, OAuth and non-human identity inventory, excessive-permission detection, dormant-integration identification, cross-SaaS policies, API monitoring, and automated remediation.
Recommended Free Tools
These products are not interchangeable. A SIEM can ingest Salesforce logs without understanding effective SaaS permissions. An identity-governance platform can run access reviews without detecting anomalous API behavior. A privileged-access tool may be stronger for privileged machine credentials than for broad SaaS connector governance. The right control depends on whether the problem is Salesforce-specific monitoring, cross-SaaS visibility, identity review, or incident detection.
No product eliminates the need for an accurate connected-app inventory, least-privilege permissions, token lifecycle management, log retention, rapid revocation, and a tested vendor-response plan.
Bottom line
The Gainsight incident was a major warning about trusted integrations, not evidence that Salesforce’s core platform was vulnerable. Older OAuth credentials associated with a widely used connected application created a possible route into more than 200 Salesforce environments, while the publicly confirmed population with affected data remained much smaller.
For Salesforce administrators, the durable lesson is straightforward: treat connected applications and OAuth tokens as privileged identities. Know which integrations exist, what they can access, how long their tokens live, where their API activity is logged, and how quickly access can be revoked when a vendor reports suspicious activity.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
