Gainsight Expands Impacted Customer List Following Salesforce Security Alert

Du'aine Davis

Observed in the wild

• On 19 November, Salesforce detected suspicious API calls via the Gainsight Connected App from non-whitelisted IPs, initially affecting three customer orgs, later expanded to more. As a precaution, Salesforce revoked Gainsight’s connected app access, disrupting integrations with Salesforce and third-party connectors (e.g., Gong, Zendesk, HubSpot). Gainsight engaged Mandiant for forensic investigation and began issuing customer guidance.
• The activity involved unauthorised API calls using OAuth tokens scoped to individual customer orgs. Indicators of compromise include specific IP addresses and user agents. Attackers exploited the Gainsight-Salesforce integration, but no evidence yet of broader compromise or data exfiltration. Google also disabled OAuth clients linked to Gainsight as a precaution.
• Customers should rotate all access keys and OAuth secrets, reset NXT passwords for non-SSO users, and re-authorise integrations. Gainsight recommends logging in directly to NXT (not via Salesforce) until restoration. Review Salesforce logs for anomalous API calls and enforce IP restrictions at the profile level. Gainsight will provide reauthorisation checklists post-restoration; monitor for IOCs and whitelist Gainsight IPs where applicable.

Salesforce Security Advisory relating to Gainsight (FAQs) | Gainsight Community
Security Advisory: Unusual Activity related to the Gainsight application