{"id":1475,"date":"2026-09-21T23:59:41","date_gmt":"2026-09-22T04:59:41","guid":{"rendered":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/?p=1475"},"modified":"2026-09-22T00:01:07","modified_gmt":"2026-09-22T05:01:07","slug":"salesforce-gainsight-breach-las-vegas","status":"publish","type":"post","link":"https:\/\/cmitsolutions.com\/lasvegas-nv-1206\/blog\/salesforce-gainsight-breach-las-vegas\/","title":{"rendered":"Salesforce Vendor Breach: Las Vegas Business Risk Guide"},"content":{"rendered":"
\nCybersecurity Alert<\/span><\/p>\n

Salesforce Third-Party App Breach: What It Means for Las Vegas Businesses<\/h2>\n

A connected-app breach tied to Salesforce customer data hit 200+ companies this fall — and the attackers are the same group linked to a recent Las Vegas resort breach. Here is what to check now.<\/p>\n

Published by CMIT Solutions of Las Vegas · Cybersecurity · 6 min read<\/p>\n<\/div>\n

A Vendor You’ve Never Heard Of Just Put Your CRM Data at Risk<\/h2>\n

Salesforce this month confirmed that a connected third-party application, Gainsight<\/strong>, was used as the entry point for unauthorized access to customer data across more than 200 organizations<\/strong>. Nobody’s Salesforce password was cracked and no Salesforce platform vulnerability was involved — the attackers instead abused OAuth access tokens that Gainsight’s app had been granted to connect to customer CRM instances. Salesforce responded by revoking active tokens tied to Gainsight-published apps and pulling them from the AppExchange while the investigation continues.<\/p>\n

This is the second<\/strong> Salesforce-connected-app incident this year — an earlier wave hit customers through the Salesloft Drift integration — and researchers tracking both point to the same cluster of threat actors, identified in reporting as ShinyHunters \/ UNC6240<\/strong>. That name should sound familiar to anyone following Las Vegas hospitality security: it is the same group linked to the Wynn Resorts vendor breach reported earlier this year. The pattern is consistent — rather than attacking a company directly, these actors compromise a smaller SaaS vendor that has been granted broad, standing access into hundreds of customers’ systems, then walk through that open door.<\/p>\n

\nKey Takeaway<\/span>
\nYour business does not need to use Salesforce or Gainsight to be exposed by this pattern. Any CRM, marketing platform, help desk tool, or accounting system with a “connect an app” menu carries the same risk — a vendor you trust granting a vendor you’ve never vetted standing access to your customer data.<\/em>\n<\/div>\n

How the Attack Actually Works<\/h2>\n

This isn’t a phishing email or a stolen password story — it’s a supply-chain and permissions story, which is exactly why it slips past the defenses most small businesses have in place:<\/p>\n