how it happened
- whoShinyHuntersreused a proven route
- the gapGainsight connectionbroad standing access
- the result200+ organisationssecond wave of 2025
what everyone assumed
After the first wave, it was comfortable to file Salesloft as a story about Salesloft. One vendor’s token handling, one incident response, one hardening effort, and the industry moves on. Companies that were not Drift customers read the coverage as news rather than as a description of their own connected-app list. A single event can always be an outlier.
what happened
The conditions for the second wave were the same ones sitting in thousands of Salesforce tenants: integrations granted broad standing access, trusted since the day of the consent screen, monitored by nobody on the customer side. Gainsight’s connection was one of many such doors. The attackers who had proven the route in August did what proven routes invite.
step by step
- August 2025a first wave proves the integration routeAttackers reach Salesforce data through a connected app.
- integrations keep broad standing accessTrusted since the consent screen, watched by nobody on the customer side.the assumption breaks here
- November 2025Gainsight's connection is usedData reached across a reported 200 plus organisations; ShinyHunters claims it.
- about 1,000 organisations across 2025's wavesThe second wave settles what the first raised.
how it surfaced
SecurityWeek and The Register reported the campaign in November 2025: data reached across a reported 200+ organizations through the Gainsight integration, with the ShinyHunters group claiming responsibility. Taken together, the Salesforce-integration waves of 2025 reached data across roughly 1,000 organizations. The second wave settled the question the first had raised.
One incident is an event; the second is a pattern.
Any vendor holding standing tokens into many customers’ systems is the same shape as Drift and Gainsight, whatever it sells, and the pattern will keep running for as long as the shape stays common. The durable lesson concerns what a consent screen creates, and how long that grant lives unwatched, at whichever vendor holds it.
picture it at a company like yours
The company here is made up. The other two paths are not: they happened, and each links to the story.
- in this storythe day it mattersOne app vendor is breached and its connection into your CRM is used.what it costs youYour customer records are copied out through a door you approved years ago.
- or it goes like thisit happenedSalesloft / Drift, 2025howA chat tool's key into your CRM is stolen from the vendor.what leavessupport tickets, including passwords pasted into themwho ends up with itan extortion group working through hundreds of companies
- or it goes like thisit happenedGitHub OAuth tokens, 2022howIntegration keys to your code host are stolen from the integration vendor.what leavesyour private code and the secrets inside itwho ends up with itattackers looking for the next door
sources
your turn
what you can do about it
this week
Count how many of your connected apps could reproduce the Gainsight story, and pick one to re-scope or remove.
Somewhere in your Salesforce, or your Google Workspace, or your Microsoft tenant, sits an integration with the same profile: broad scopes, standing access, no owner who could describe what it reads. The companies hit in November had three months of warning and read it as someone else's news.
go deeper
if you're not sure where to start
Run the offboarding checklist on one leaver. It covers every account and token to close when someone leaves.
open the checklist →