Salesforce data breach (2025): how ShinyHunters raided customer instances through vishing and OAuth apps
Through 2025 a string of household names disclosed breaches of “a third-party CRM”. Most traced to Salesforce instances, yet the FBI, Google and Salesforce all say the platform itself was not broken. This page is the running record of that wave: the voice-phishing campaign, the Salesloft Drift and Gainsight token thefts, the extortion leak site and Salesforce’s refusal to pay.
Short answer
Was Salesforce hacked?
Not the platform, according to Salesforce, Google and the FBI, but many customers’ Salesforce instances were. The FBI’s September 2025 FLASH describes two groups: UNC6040, which since October 2024 has phoned companies’ help desks posing as IT support and talked staff into authorising a malicious copy of Salesforce Data Loader, and UNC6395, which used OAuth tokens stolen from the Salesloft Drift integration to export data from customer instances between 8 and 18 August 2025.
Salesforce and Salesloft revoked all Drift tokens on 20 August 2025. In October 2025 an extortion group linked to ShinyHunters launched a leak site claiming more than a billion records; Salesforce said it would “not engage, negotiate with or pay any extortion demand.” In November 2025 Salesforce revoked tokens for Gainsight-published apps after a similar theft, with Google aware of more than 200 potentially affected instances.
Timeline at a glance
Oct 2024 →UNC6040 voice-phishing help desks into approving a malicious Data Loader app. (FBI FLASH)Confirmed
8–18 Aug 2025UNC6395 uses stolen Salesloft Drift OAuth tokens to export data from many instances. (Google GTIG)Confirmed
20 Aug 2025Salesloft and Salesforce revoke all Drift tokens; Drift pulled from AppExchange. (Google GTIG)Confirmed
12 Sep 2025FBI FLASH publishes indicators for UNC6040 and UNC6395. (FBI)Confirmed
Oct 2025Leak site claims 1bn+ records; Salesforce refuses to pay. (Cybersecurity Dive)Confirmed
Nov 2025Gainsight-published app tokens revoked; 200+ instances potentially affected. (The Register)Confirmed
Last updated October 30, 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Salesforce incident timeline, in detail
Confirmed = acknowledged by Salesforce, a regulator filing or a court. Reported = credible reporting Salesforce has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Oct 2024 – 2025ConfirmedSocial engineering / SaaS tenant
UNC6040: help-desk vishing and malicious connected apps
What happened. The FBI says UNC6040 actors call victims’ call centres posing as IT support, steer staff to a phishing page or to Salesforce’s connected-app setup page, and get them to approve a malicious app, often a modified Data Loader. The approved app then queries and exports data in bulk. Authorising a malicious connected app bypasses MFA and password resets.
Impact. Customer data stolen from many companies’ Salesforce instances. Google said one of its own corporate Salesforce instances was hit by similar UNC6040 activity in June 2025; TechCrunch lists Allianz Life, Cisco and Workday among the other 2025 Salesforce-related thefts. Several victims described it only as a “third-party CRM”.
8–20 Aug 2025ConfirmedThird-party integration / OAuth
UNC6395: stolen Salesloft Drift OAuth tokens used to export data at scale
What happened. Google’s threat-intelligence team says UNC6395 used compromised OAuth tokens tied to the Salesloft Drift app to export large volumes of data (cases, accounts, users, opportunities) from numerous corporate Salesforce instances, then searched it for secrets such as AWS keys, passwords and Snowflake tokens. Google states the issue “does not stem from a vulnerability within the core Salesforce platform.”
Impact. Salesloft and Salesforce revoked all active Drift access and refresh tokens on 20 August 2025 and removed Drift from the AppExchange. The actor mined the stolen support data for credentials to use in further intrusions.
What happened. A ShinyHunters-linked group launched a leak site claiming more than one billion records, tied to 39 companies hit by vishing and 760 organisations via the Drift tokens, and made an extortion demand to Salesforce. Salesforce told customers: “I can confirm Salesforce will not engage, negotiate with or pay any extortion demand.”
Impact. Record and victim counts are the group’s claims and are not verified.
Gainsight-published apps: tokens revoked after a second integration theft
What happened. Salesforce revoked all active access and refresh tokens for Gainsight-published applications connected to Salesforce and temporarily removed them from the AppExchange while it investigated. Google said it was aware of more than 200 potentially affected Salesforce instances. ShinyHunters claimed it reached Gainsight through the earlier Salesloft breach.
Impact. A second integration-token theft within three months, confirming the pattern.
“Salesforce breach” vs “customer breach”: victims, the press and the attackers call it a Salesforce breach; Salesforce, Google and the FBI say no platform vulnerability was involved and the access came through customers’ users and third-party apps.
Scale: the attackers claim more than a billion records from about 760 organisations; Google speaks of “numerous” instances for Drift and “more than 200” for Gainsight. Neither total is independently verified.
The pattern across the record
The tenant is yours, so is the breach
Shared responsibility in practice: the vendor secured the platform, while attackers walked in through customers’ staff and the apps those customers had approved.
Connected apps are a supply chain
Each approved integration holds a long-lived token that bypasses MFA. Drift and Gainsight showed that one integrator’s compromise exposes every tenant that trusted it.
What it means for Salesforce customers — and what to do
If your company runs Salesforce, the controls that would have stopped this wave are in your own org settings, not Salesforce’s.
1.Inventory and prune connected apps
List every OAuth-connected app, remove unused ones, and require admin approval for new ones. Restrict who can authorise apps.
Salesforce, Google and the FBI say the Salesforce platform was not breached. Attackers stole data from many customers’ Salesforce instances in 2025 by voice-phishing staff into approving malicious apps and by using OAuth tokens stolen from third-party integrations (Salesloft Drift, then Gainsight).
Who is behind the Salesforce data breaches?+
Google tracks the clusters as UNC6040 and UNC6395; the extortion side uses the ShinyHunters name. The FBI published indicators for both clusters in September 2025.
Did Salesforce pay the ransom?+
No. In October 2025 Salesforce said it “will not engage, negotiate with or pay any extortion demand.”
What was the Salesloft Drift breach?+
Between 8 and 18 August 2025, UNC6395 used OAuth tokens stolen from the Salesloft Drift integration to export data from numerous Salesforce instances. Salesloft and Salesforce revoked all Drift tokens on 20 August.
How do I protect my Salesforce org?+
Restrict who can approve connected apps, prune unused integrations, limit API and Data Loader access to named users and IP ranges, alert on bulk exports, use phishing-resistant MFA, and remove secrets from support cases.
More in the Breach Index
Same sourced, verification-tagged timeline, company by company — compare how peers have fared.
Independent analysis for security-leadership education; not affiliated with or endorsed by Salesforce. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🎉 New here? Use code WELCOME10 for 10% off any plan at checkout