Salesforce Vendor Breach: Las Vegas Business Risk Guide

A Vendor You’ve Never Heard Of Just Put Your CRM Data at Risk

Salesforce this month confirmed that a connected third-party application, Gainsight, was used as the entry point for unauthorized access to customer data across more than 200 organizations. Nobody’s Salesforce password was cracked and no Salesforce platform vulnerability was involved — the attackers instead abused OAuth access tokens that Gainsight’s app had been granted to connect to customer CRM instances. Salesforce responded by revoking active tokens tied to Gainsight-published apps and pulling them from the AppExchange while the investigation continues.

This is the second Salesforce-connected-app incident this year — an earlier wave hit customers through the Salesloft Drift integration — and researchers tracking both point to the same cluster of threat actors, identified in reporting as ShinyHunters / UNC6240. That name should sound familiar to anyone following Las Vegas hospitality security: it is the same group linked to the Wynn Resorts vendor breach reported earlier this year. The pattern is consistent — rather than attacking a company directly, these actors compromise a smaller SaaS vendor that has been granted broad, standing access into hundreds of customers’ systems, then walk through that open door.

How the Attack Actually Works

This isn’t a phishing email or a stolen password story — it’s a supply-chain and permissions story, which is exactly why it slips past the defenses most small businesses have in place:

• OAuth tokens, not passwords. When you click “Allow” to connect an app to your CRM, that app receives a long-lived access token — not tied to MFA, not visible in a normal login-audit log.
• Broad scopes by default. Most connected apps request far more read/write access than they need, and most admins accept the default request without narrowing it.
• The vendor becomes the blast radius. When attackers compromise the app vendor itself (Gainsight, in this case), every one of that vendor’s customers is exposed simultaneously — over 200 organizations in a single incident.
• Data exfiltration, not ransomware. The goal here was bulk customer and contact data for extortion or resale, which means the damage is often discovered from a ransom email, not a system outage.

What’s Actually at Stake for Las Vegas Businesses

• ⚠Customer and prospect contact data — names, emails, phone numbers, deal history — sitting in whatever CRM or marketing tool your business runs
• ⚠Hospitality, gaming-adjacent, healthcare, and professional-services firms in Las Vegas that layer multiple SaaS integrations on top of a core CRM or EHR
• ⚠Vendor and partner trust — a breach traced back to your systems, even when the root cause was a third-party app, still lands on your business’s reputation
• ⚠Compliance exposure for regulated industries — healthcare, legal, and government-contractor clients that must document who has access to protected data, including through vendor connections
• ⚠Follow-on phishing — stolen CRM contact data is routinely used to craft convincing, personalized follow-up scams against the very customers whose data was taken

Three Gaps We Find in Almost Every Small Business Audit

Defending Las Vegas with CMIT Solutions

Vendor and supply-chain breaches don’t respect company size — they respect whatever access was granted and never revisited. CMIT Solutions of Las Vegas builds vendor and connected-app reviews into every managed cybersecurity plan, so when the next SaaS integration makes headlines, our clients already know exactly what’s connected to their systems and can act the same day.