Cloud security is once again being put to the test. This time, the impact is hitting companies that use Gainsight integrations inside the Salesforce ecosystem. What started as a limited alert about suspicious activity quickly escalated into a much broader incident, with additional customers affected and a known cybercriminal group claiming responsibility.
If you or your company depend on Salesforce integrations, this case is a clear warning: even your most trusted tools can become entry points for attackers if a third-party provider is compromised. At TecnetOne, we break down what you need to know and how to protect yourself.
Gainsight revealed that the initial list of three compromised customers—originally communicated by Salesforce—was incomplete. After November 21, 2025, the company confirmed that the number of affected clients has grown, though they did not disclose the exact figure.
Gainsight CEO Chuck Ganapathi attempted to reassure the public, stating that “only a handful of customers have data truly affected.” However, the situation made it clear that the real impact is still being evaluated.
The alert originated when Salesforce detected unusual activity from Gainsight-published applications connected to its platform. To contain the incident, Salesforce revoked all access and refresh tokens associated with those apps.
Soon after, the cybercriminal group ShinyHunters—also known as Bling Libra—claimed responsibility for the breach.
To minimize risk, several providers that depend on Gainsight immediately took action:
This highlights a growing pattern: when one provider is compromised, dependent integrations react quickly to prevent a supply-chain-style cascade attack.
Read more: Attacks on Salesforce: Hackers Target Accounts with Social Engineering
Gainsight published a list of products whose read/write capabilities within Salesforce were temporarily suspended:
Although Gainsight insisted Staircase had not been compromised, Salesforce cut its connection as a precaution while the investigation continues.
Salesforce and Gainsight both released IoCs related to the breach. One of the most notable was the user-agent:
“Salesforce-Multi-Org-Fetcher/1.0”
This same user-agent was seen in earlier activity linked to Salesloft Drift, suggesting shared tactics or tools among cybercriminal groups.
According to Salesforce:
In practical terms: the attackers were active for weeks before detection and containment.
Gainsight issued several recommended defensive steps. If you use Salesforce or any cloud integration, you should implement them immediately:
Including:
Avoid doing so through Salesforce until the integration is fully restored.
Especially those who do not use SSO.
4. Reauthorize all integrations and connected apps
Any tool that relies on tokens or credentials should receive new authorizations.
Gainsight clarified that these are preventive steps designed to protect customer environments during the ongoing investigation.
Similar titles: Lethal Hacker Alliance: ShinyHunters and Scattered Spider Strike
This incident comes amid the rise of a new ransomware-as-a-service (RaaS) platform known as ShinySp1d3r (Sh1nySp1d3r), developed by an alliance between:
According to ZeroFox, this alliance is behind over 51 cyberattacks in a single year.
More concerning than the number of attacks is the sophistication. ShinySp1d3r introduces techniques rarely seen in other RaaS operations:
This combination shows that organized cybercrime is already operating with techniques once seen only in advanced APT teams.
Journalist Brian Krebs identified the ransomware’s developer as a core SLSH member known as “Rey” (@ReyXBF). He is one of the administrators of the group’s Telegram channel and previously ran BreachForums and the HellCat ransomware leak site.
His real identity: Saif Al-Din Khader.
Khader even claimed that ShinySp1d3r is a modified version of HellCat developed using AI-assisted tools. Most surprising of all: he says he has been cooperating with authorities since June 2025, raising the possibility of undercover operations or negotiated immunity.
The Gainsight–Salesforce case highlights a growing reality:
Attackers aren’t just targeting you—they’re targeting your providers.
And if a provider falls, the breach can spread to:
This is why, at TecnetOne, we emphasize the importance of:
Your chain is only as strong as the weakest link—and that weak link can easily be a provider you rarely examine.