Gainsight on Monday said connections to Zendesk and Hubspot have been temporarily paused following a supply chain attack targeting its integration with Salesforce.
Last week, Salesforce launched an investigation into an attack targeting its connection with Gainsight, a software company that helps companies improve customer retention and efficiency.
Researchers at Google Threat Intelligence Group last week said the ShinyHunters threat group is linked to more than 200 cases where Salesforce customer data may have been breached through the Gainsight connection.
As the investigation moves forward, Salesforce revoked all active and refresh tokens that were linked to Gainsight-published applications.
Multiple Gainsight products have been impacted, including Community – CC, Skilljar – SJ and Northpass – CE, according to an updated security post from Gainsight. The products remain operational, but they cannot currently read and write from Salesforce, according to the Gainsight post.
Gainsight said that integrations to Gong have also been deactivated.
Gainsight said it has taken several steps to harden its environment, including rotating multifactor credentials used to access VPN and critical systems.
Customers are being asked to rotate their S3 keys as a precautionary measure.
Hubspot said there is no evidence the company or Hubspot customers have been impacted by the attacks. However, its the Gainsight integration will remain deactivated until the investigation is complete.
Mandiant, the incident response arm of GTIG, is conducting a forensic review of tokens, logs and Connector activity, according to Gainsight.
Salesforce on Saturday reiterated that the attack appears to be linked to the app’s external connection to Salesforce and not any vulnerability in the Salesforce platform. Salesforce customers were previously targeted in an August attack using an integration with Salesloft Drift.
In October, hackers attempted to shake down Salesforce using data stolen in a couple of different campaigns, including the Salesloft Drift attacks. Salesforce said it would not submit to the demands.
