Deja Vu: Salesforce Customers Hacked Again, Via Gainsight

darkreading

November 21, 2025 at 9:22 PM

Actively Exploited

Overview

Salesforce customers have been targeted again by threat actors from the ShinyHunters group, who exploited a third-party application to access sensitive Salesforce data. This repeated attack highlights the ongoing vulnerabilities associated with third-party integrations and the need for enhanced security measures.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Salesforce, Gainsight
Action Required: Organizations should review and enhance their security protocols for third-party applications, conduct regular security assessments, and ensure that data access is tightly controlled.
Timeline: Ongoing since summer

Original Article Summary

In a repeat of similar attacks during the summer, threat actors affiliated with the ShinyHunters extortion group used a third-party application to steal organizations' Salesforce data.

Impact

Salesforce, Gainsight

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since summer

Remediation

Organizations should review and enhance their security protocols for third-party applications, conduct regular security assessments, and ensure that data access is tightly controlled.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Data Breach.

Read Original Article

Related Coverage

New StackWarp Attack Threatens Confidential VMs on AMD Processors

SecurityWeek

Researchers have revealed a new vulnerability dubbed the StackWarp Attack that targets AMD processors, enabling attackers to execute code remotely within confidential virtual machines (VMs). This flaw poses a significant risk to cloud environments where sensitive data is processed, as it could allow unauthorized access to protected information. The attack exploits weaknesses in the architecture of AMD processors, making it particularly concerning for organizations relying on these systems for secure operations. Companies using AMD processors in their cloud infrastructure should assess their systems for vulnerabilities and stay informed about potential patches or mitigations that may be issued in response to this discovery. The implications of this attack are serious, especially for sectors dealing with confidential data such as finance, healthcare, and government.

Jan 15, 2026

Bluspark Global patches critical vulnerabilities after data exposure

SCM feed for Latest

Security researcher Eaton Zveare identified five serious vulnerabilities in Bluspark's Bluvoyix platform, which is used in shipping and supply chain management. Among these flaws were the use of plaintext passwords and an unauthenticated API, both of which could potentially allow unauthorized access to sensitive data. This incident raises concerns for companies relying on Bluvoyix, as attackers could exploit these weaknesses to gain access to critical operational information. Bluspark has since released patches to address these vulnerabilities, but the exposure of such significant flaws underscores the need for robust security practices in software development. Users of the platform should ensure they update to the latest version to mitigate these risks.

Jan 15, 2026

Federal cyber defense prioritization sought by lawmakers, experts

SCM feed for Latest

During a recent House Homeland Security subcommittee hearing, U.S. lawmakers and cybersecurity experts called for a stronger focus on enhancing the country’s cyber defenses. They expressed concern that expanding offensive cyber operations against foreign threats could leave domestic systems vulnerable. Experts emphasized the need for prioritizing cybersecurity measures to protect critical infrastructure and data from potential attacks. The discussion reflects a growing consensus that the U.S. must balance offensive strategies with robust defensive capabilities to effectively safeguard against rising cyber threats. This emphasis on defense is crucial as the landscape of cyber warfare evolves, making it vital for the U.S. to be prepared for both offensive and defensive actions.

Jan 15, 2026

Global Agencies Release New Guidance to Secure Industrial Networks

Infosecurity Magazine

The Cybersecurity and Infrastructure Security Agency (CISA), the UK's National Cyber Security Centre (NCSC), and the FBI have issued new guidance aimed at improving security for Operational Technology (OT) environments. This guidance comes in response to the increasing number of cyber threats targeting critical infrastructure, which often relies on OT systems. These systems manage physical processes in industries such as manufacturing, energy, and transportation. The agencies emphasize the need for organizations to adopt better security measures, including risk assessments and incident response strategies, to defend against potential cyberattacks. This initiative is crucial as vulnerabilities in OT can have severe consequences, affecting not only the organizations themselves but also public safety and national security.

Jan 15, 2026

CodeBuild Flaw Put AWS Console Supply Chain At Risk

Infosecurity Magazine

A misconfiguration in AWS CodeBuild has left key repositories vulnerable to potential attacks. This flaw could allow unauthorized access to sensitive data stored within those repositories, posing a significant risk to companies relying on AWS for their software development and deployment processes. Developers and organizations using AWS CodeBuild should be aware of this vulnerability and take immediate action to secure their environments. The issue emphasizes the need for stringent security practices, especially in cloud-based development tools. As this misconfiguration could impact a wide range of users, timely remediation is essential to prevent exploitation.

Jan 15, 2026

Cyber Threat Actors Ramp Up Attacks on Industrial Environments

Infosecurity Magazine

A recent report from Cyble reveals that hacktivists and cybercriminals are increasingly targeting industrial systems, looking to exploit vulnerabilities within these environments. This uptick in attacks poses significant risks to companies operating in sectors such as manufacturing, energy, and utilities, potentially leading to disruptions in operations and financial losses. The report emphasizes the critical need for these organizations to enhance their cybersecurity measures and patch known vulnerabilities to safeguard their systems. As attackers become more sophisticated, the potential for severe consequences, including data breaches and operational downtime, grows. Companies must prioritize security protocols to protect their infrastructure from these escalating threats.

Jan 15, 2026