Gainsight has revealed that more users than previously believed have been impacted by the recent suspicious behavior targeting its applications.
According to the firm, as of November 21, 2025, Salesforce had “expanded to a larger list” from the initial list of three affected customers. Although the precise number of affected consumers was not disclosed, Chuck Ganapathi, the company’s CEO, stated that we currently only know of a small number of clients whose data was compromised.
Salesforce withdraw all access and refresh tokens linked to Gainsight-published applications connected to the platform after receiving a warning about “unusual activity” related to those applications. The infamous cybercrime group ShinyHunters, also known as Bling Libra, has claimed the breach.
To contain the situation, several other preventative measures have been implemented. This includes Google disabling OAuth clients with callback URIs read more about Gainsight Expands Impacted Customer List Following Salesforce Security Alert.
Get up to date on the latest cybersecurity news and enhance your knowledge of cybersecurity with our thorough coverage of the dangers, breaches, and solutions.