Gainsight

Gainsight, a customer management software firm, experienced a security breach that compromised a limited number of its clients' data. The incident was disclosed by CEO Chuck Ganapathi and involved the exposure of **Salesforce customer tokens**, which are critical for authentication and access control within Salesforce ecosystems. While the breach did not result in a large-scale data leak, the unauthorized access to these tokens could potentially allow attackers to impersonate legitimate users, access sensitive customer information, or disrupt business operations tied to Salesforce integrations. The breach highlights vulnerabilities in third-party SaaS platforms that rely on interconnected systems like Salesforce. Although the impact was contained to a subset of clients, the exposure of authentication tokens poses risks such as credential stuffing, unauthorized API calls, or lateral movement within compromised accounts. The company has not disclosed whether the breach stemmed from a targeted cyber attack, an unpatched vulnerability, or an internal misconfiguration. However, the involvement of Salesforce tokens suggests a sophisticated intrusion, as these are high-value targets for threat actors seeking to exploit enterprise environments. The financial and reputational repercussions for Gainsight may include client churn, regulatory scrutiny (depending on data protection laws like GDPR or CCPA), and erosion of trust among enterprise customers who rely on the platform for secure customer success management. Mitigation efforts likely involve token revocation, multi-factor authentication enforcement, and forensic investigations to determine the attack vector and prevent recurrence.

Source: https://www.scworld.com/brief/alleged-att-breach-compromises-31m-records

TPRM report: https://www.rankiteo.com/company/gainsight

"id": "gai4753947113025",
"linkid": "gainsight",
"type": "Breach",
"date": "5/2025",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Limited number of clients',
                        'industry': 'Technology / SaaS',
                        'name': 'Gainsight',
                        'type': 'Customer Management Software Firm'},
                       {'industry': 'Technology / SaaS',
                        'name': 'Salesforce (indirectly impacted via tokens)',
                        'type': 'CRM Platform'}],
 'data_breach': {'type_of_data_compromised': ['Salesforce customer tokens']},
 'date_publicly_disclosed': '2025-11-26',
 'description': 'A limited number of Gainsight clients had their data '
                'compromised following a breach of the customer management '
                "software firm's systems, which impacted Salesforce customer "
                'tokens.',
 'impact': {'data_compromised': True,
            'systems_affected': ['Salesforce customer tokens']},
 'references': [{'date_accessed': '2025-11-26', 'source': 'CyberScoop'}],
 'response': {'communication_strategy': {'public_disclosure_by': 'CEO Chuck '
                                                                 'Ganapathi'}},
 'title': 'Gainsight Data Breach Affecting Salesforce Customer Tokens',
 'type': 'Data Breach'}