Salesforce investigates customer data theft via Gainsight breach

Salesforce revoked access and refresh tokens for Gainsight-published applications after detecting unusual activity that may have enabled unauthorized access to customer Salesforce data; Salesforce temporarily removed those apps from the AppExchange and notified affected customers. The incident is tied to stolen OAuth tokens and is presented as similar to an earlier Salesloft breach (attributed to extortion groups such as ShinyHunters/Scattered Lapsus$ Hunters) that exposed credentials and cloud access tokens across hundreds of organizations; ShinyHunters claim they accessed an additional 285 Salesforce instances via the Gainsight compromise.