ShinyHunters 'does not like Salesforce at all'

"We've had access to Gainsight for nearly 3 months."

"The data from Salesloft Drift breached has enabled entry points into so many systems. Very lucrative systems,"

"I do not like Salesforce at all, would be nice if they stopped acting all high and mighty and just pay to fix this mess."

"We continue to work on the ongoing investigation into the connection issue affecting Gainsight-published applications on Salesforce,"

"activity under investigation originated from the applications' external connection - not from any issue or vulnerability within the Salesforce platform."

ShinyHunters claims access to Gainsight via credentials obtained during the Salesloft Drift breach and reports nearly three months of access. Attackers stole OAuth tokens from Salesloft Drift's Salesforce integration, enabling silent exfiltration of Salesforce customer data and entry into other integrated systems. Gainsight integrates with Salesforce, HubSpot, and Zendesk and has engaged Google's Mandiant to investigate connection issues affecting Gainsight-published Salesforce applications. Gainsight states that the activity originated from external application connections and not from a vulnerability within the Salesforce platform. Salesforce revoked active access tokens in response to the incident.

Read at Theregister