Salesforce Customers Targeted in New Data Breach Following Gainsight Incident
SAN FRANCISCO, CA - November 1, 2025 – Salesforce customers are facing potential data exposure after a hacking group claimed to have stolen data from nearly a thousand companies through a breach linked to Gainsight, a customer success platform integrated with Salesforce. The hackers are threatening to publish the stolen data on a new website if ransoms are not paid – a common tactic employed by financially-motivated cybercriminals.
the breach appears connected to a series of incidents originating with an August compromise of AI marketing chatbot maker Salesloft, which allowed attackers to access connected Salesforce instances. This latest development underscores the growing risk of supply chain attacks and the vulnerability of customer data stored within widely-used platforms like Salesforce.Gainsight previously confirmed it was among the victims of the Salesloft-linked breaches, though it remains unclear if this new wave originated from the earlier compromise.
According to a report by DataBreaches.net, the hacking group warned they “don’t negotiate with them, they will create a new website to advertise the stolen data.” The hackers claim to have stolen data from close to a thousand companies and stated, “The next [data leak site] will contain the data of the Salesloft and GainSight campaigns.”
This incident is part of a larger pattern of attacks targeting Salesforce customers. previous victims of similar breaches include insurance giant Allianz Life, Bugcrowd, Cloudflare, Google, fashion conglomerate Kering, Proofpoint, airline Qantas, carmaker Stellantis, credit bureau TransUnion, and employee management platform Workday.
The hacking group,identified as Scattered Lapsus$ Hunters - which reportedly includes the ShinyHunters gang – claimed duty for the Salesloft breaches and previously launched a dedicated website to extort victims,threatening to release a billion records. Gainsight has acknowledged the earlier breaches but has not yet commented on this latest claim.
