Salesforce said on Wednesday that it’s investigating a breach of “certain customers’ Salesforce data” that was compromised through apps published by Gainsight, a company that sells a platform for other companies to manage their customers.
In a notice published late Wednesday, Salesforce said the hacks involve “Gainsight-published applications connected to Salesforce, which are installed and managed directly by customers.”
Salesforce said that there is “no indication that this issue resulted from any vulnerability in the Salesforce platform,” and that the activity appears related to Gainsight’s “external connection to Salesforce.”
Gainsight said in a status page that it is investigating a “Salesforce connection issue,” without making any reference to a potential breach. “Our internal investigation is ongoing,” Gainsight wrote.
ShinyHunters told DataBreaches.net that it was behind the breach, adding that if Salesforce doesn’t negotiate with them, they will create a new website to advertise the stolen data — a common extortion tactic by financially-motivated cybercriminals.
“The next [data leak site] will contain the data of the Salesloft and GainSight campaigns,” the hackers told DataBreaches.net. The hackers claim to have stolen data from close to a thousand companies.
In the case of the Salesloft breaches, the hacking group Scattered Lapsus$ Hunters, which apparently includes the ShinyHunters gang, claimed responsibility.
In a statement to TechCrunch, CrowdStrike spokesperson Kevin Benacci noted that the company is “not affected by the Gainsight issue and all customer data remains secure.”
However, CrowdStrike confirmed that it dismissed a “suspicious insider” who allegedly shared information with hackers.
Verizon spokesperson Kevin Israel said that the company “is aware of the unsubstantiated claim by the threat actor,” but did not provide evidence to support the claim.
Malwarebytes spokesperson Ashley Stewart added that the company’s security team is “aware” of the Gainsight and Salesforce issues and is “actively investigating the matter.”
Meanwhile, Michael Adams, chief information security officer at DocuSign, highlighted that through “comprehensive log analysis and internal investigation, we have no indication of Docusign data compromise at this time.”
Adams also noted that “out of an abundance of caution, we have taken a number of measures including terminating all Gainsight integrations and containing related data flows.”
Salesforce spokesperson Nicole Aranda said that “as a matter of policy, Salesforce does not comment on specific customer issues.”