Hackers steal 200 companies data hacking Salesforce

Hackers stole data from more than 200 companies that use Salesforce, Google said after the Gainsight incident was disclosed. It was part of a large-scale supply chain attack that affected a number of well-known companies.

More than 200 Salesforce instances were affected, according to Google Threat Intelligence analyst Austin Larsen. Salesforce confirmed that “select customer data” was compromised, but did not name specific companies. The leak occurred through third-party applications Gainsight uses for customer service. Gainsight previously used tools Salesloft and Drift, through which the attackers gained access to authentication tokens.

The Scattered Lapsus$ Hunters group, which is affiliated with the ShinyHunters, Lapsus$, and Scattered Spider groups, claimed responsibility for the attack. Their Telegram channel states that the attack affected Atlassian, Docusign, GitLab, CrowdStrike, Malwarebytes, SonicWall, Thomson Reuters, Verizon, and others.

Several companies have already commented on the situation: CrowdStrike said that its data was not affected, although a suspected insider was fired. Docusign did not find a compromise, but disabled the Gainsight integration for security reasons. Thomson Reuters, Malwarebytes, and Verizon are conducting their own investigations.

Gainsight said that the incident was not related to the Salesforce vulnerability, but was a result of an external integration. The company is working with Google Mandiant for an independent analysis, and Salesforce has temporarily revoked active Gainsight application tokens. Scattered Lapsus$ Hunters announced the launch of a website by next week with the aim of blackmailing the affected companies.