Salesforce Flags Unauthorized Data Access via Gainsight-Linked OAuth Activity

The Hacker News

November 21, 2025 at 5:32 AM

Overview

Salesforce has detected unusual activity linked to Gainsight applications that may have led to unauthorized access to customer data. The company has responded by revoking all active access to mitigate potential risks.

Key Takeaways

Affected Systems: Salesforce platform, Gainsight applications
Action Required: Revoked all active access and refresh tokens related to the Gainsight applications.
Timeline: Newly disclosed

Original Article Summary

Salesforce has warned of detected "unusual activity" related to Gainsight-published applications connected to the platform. "Our investigation indicates this activity may have enabled unauthorized access to certain customers’ Salesforce data through the app's connection," the company said in an advisory. The cloud services firm said it has taken the step of revoking all active access and refresh

Impact

Salesforce platform, Gainsight applications

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Newly disclosed

Remediation

Revoked all active access and refresh tokens related to the Gainsight applications

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Data Breach.

Read Original Article

Related Coverage

Predator Spyware Sample Indicates 'Vendor-Controlled' C2

darkreading

Researchers have uncovered how Intellexa, the company behind the Predator spyware, adapts its tactics based on failed deployments and unsuccessful attacks. By analyzing these setbacks, Intellexa aims to refine its commercial spyware, making future operations more effective. This raises concerns for privacy advocates and targets who may be vulnerable to such sophisticated surveillance tools. The findings suggest that Predator could be continuously evolving, increasing the risk for individuals and organizations that may be targeted. As spyware technology becomes more advanced, the implications for personal and national security are significant.

Jan 15, 2026

Max Messenger data breach claimed by hacker on DarkForums

SCM feed for Latest

A hacker has claimed responsibility for a significant data breach involving Max Messenger, reportedly extracting 142 GB of compressed data that includes around 15.4 million user records. The exposed information consists of full names, usernames, and phone numbers, which could put many users at risk of identity theft or spam. This incident raises concerns about the security measures in place to protect user data, especially given the large volume of personal information compromised. Users of Max Messenger should be vigilant about potential phishing attempts and consider changing their passwords to enhance their security. The situation also serves as a reminder for companies to prioritize data protection and implement stronger safeguards against unauthorized access.

Jan 15, 2026

New StackWarp Attack Threatens Confidential VMs on AMD Processors

SecurityWeek

Researchers have revealed a new vulnerability dubbed the StackWarp Attack that targets AMD processors, enabling attackers to execute code remotely within confidential virtual machines (VMs). This flaw poses a significant risk to cloud environments where sensitive data is processed, as it could allow unauthorized access to protected information. The attack exploits weaknesses in the architecture of AMD processors, making it particularly concerning for organizations relying on these systems for secure operations. Companies using AMD processors in their cloud infrastructure should assess their systems for vulnerabilities and stay informed about potential patches or mitigations that may be issued in response to this discovery. The implications of this attack are serious, especially for sectors dealing with confidential data such as finance, healthcare, and government.

Jan 15, 2026

Bluspark Global patches critical vulnerabilities after data exposure

SCM feed for Latest

Security researcher Eaton Zveare identified five serious vulnerabilities in Bluspark's Bluvoyix platform, which is used in shipping and supply chain management. Among these flaws were the use of plaintext passwords and an unauthenticated API, both of which could potentially allow unauthorized access to sensitive data. This incident raises concerns for companies relying on Bluvoyix, as attackers could exploit these weaknesses to gain access to critical operational information. Bluspark has since released patches to address these vulnerabilities, but the exposure of such significant flaws underscores the need for robust security practices in software development. Users of the platform should ensure they update to the latest version to mitigate these risks.

Jan 15, 2026

Federal cyber defense prioritization sought by lawmakers, experts

SCM feed for Latest

During a recent House Homeland Security subcommittee hearing, U.S. lawmakers and cybersecurity experts called for a stronger focus on enhancing the country’s cyber defenses. They expressed concern that expanding offensive cyber operations against foreign threats could leave domestic systems vulnerable. Experts emphasized the need for prioritizing cybersecurity measures to protect critical infrastructure and data from potential attacks. The discussion reflects a growing consensus that the U.S. must balance offensive strategies with robust defensive capabilities to effectively safeguard against rising cyber threats. This emphasis on defense is crucial as the landscape of cyber warfare evolves, making it vital for the U.S. to be prepared for both offensive and defensive actions.

Jan 15, 2026

Global Agencies Release New Guidance to Secure Industrial Networks

Infosecurity Magazine

The Cybersecurity and Infrastructure Security Agency (CISA), the UK's National Cyber Security Centre (NCSC), and the FBI have issued new guidance aimed at improving security for Operational Technology (OT) environments. This guidance comes in response to the increasing number of cyber threats targeting critical infrastructure, which often relies on OT systems. These systems manage physical processes in industries such as manufacturing, energy, and transportation. The agencies emphasize the need for organizations to adopt better security measures, including risk assessments and incident response strategies, to defend against potential cyberattacks. This initiative is crucial as vulnerabilities in OT can have severe consequences, affecting not only the organizations themselves but also public safety and national security.

Jan 15, 2026