Salesforce confirmed unauthorized access to customer data via a Gainsight-managed package, a third-party SaaS connector integrated through OAuth. The breach exploited Gainsight’s compromised credentials, allowing attackers (claimed by ShinyHunters) to extract data from Salesforce instances without directly hacking Salesforce’s core infrastructure. The incident mirrors a prior Salesloft supply-chain attack, where attackers leveraged connected apps to pivot into victims’ Salesforce environments. While Salesforce denied platform vulnerabilities, the breach highlights risks of token theft, over-permissive OAuth scopes, and third-party app sprawl. The hackers threatened double extortion, hinting at stolen data from hundreds of organizations, though the exact scale and data types (e.g., customer PII, corporate records) remain unverified. Gainsight’s status page acknowledged a Salesforce connection issue but avoided labeling it a breach. The attack vector—compromised vendor tokens accessing Salesforce APIs—underscores systemic risks in SaaS supply chains, where long-lived tokens and broad permissions enable lateral movement. Customers were urged to rotate OAuth tokens, audit app permissions, and monitor logs for anomalous exports. The incident reinforces warnings from CISA about cloud-to-cloud compromises via third-party integrations, with potential fallout including reputational damage, regulatory scrutiny, and customer churn if sensitive data was exposed.