Salesforce disclosed a major security breach in November 2025, where threat actors linked to the ShinyHunters group exploited compromised OAuth tokens in Gainsight-published applications to gain unauthorized access to customer data. The attack, detected mid-November, exposed sensitive information from over 200 organizations using Gainsight’s Salesforce-integrated platform. Attackers conducted reconnaissance as early as October 23, 2025, and executed intensive unauthorized access between November 16–19, 2025, using VPNs (Mullvad, Surfshark, Proton, Tor), proxy services (IProxyShop, ProxySeller, NSocks), and custom user agents (e.g., Salesforce-Multi-Org-Fetcher/1.0) to evade detection.Salesforce disabled all Gainsight integrations, revoked affected tokens, and removed compromised apps from AppExchange. The breach did not originate from a Salesforce vulnerability but from third-party OAuth token misuse. Security firms Google Threat Intelligence Group and Mandiant assisted in tracking the attackers, who demonstrated high operational security by rotating VPNs and proxies. The incident mirrors recent attacks on Salesloft-Drift integrations, highlighting a trend of exploiting trusted SaaS integrations. Affected organizations were advised to audit connected apps, revoke suspicious tokens, and implement continuous monitoring.