The Gainsight and Salesforce incident: a connected app review checklist

In November 2025 Salesforce detected suspicious API calls from non-allowlisted IP addresses through Gainsight applications connected to its platform and revoked the tokens tied to them. The lesson is about third party OAuth apps: a token you granted to a vendor can be used from somewhere you did not expect.

What was reported

A Recorded Future write-up dates the detection to 19 November 2025 and says Gainsight confirmed on 23 November that it was investigating unusual activity involving its Salesforce integrated applications. Three unnamed customers were suspected to be affected. Several Gainsight products temporarily lost the ability to read and write Salesforce data, and some other vendors disabled their own connectors for Gainsight as a precaution.

Salesforce revoked access tokens associated with Gainsight applications, restricted integration functionality and began an investigation. Gainsight said it had found no evidence of data exfiltration so far, and no specific actor had been confirmed at the time of that report. The write-up notes some IP addresses overlapped with an earlier August 2025 campaign against Salesforce environments, and that most were anonymity infrastructure such as Tor exit nodes.

This rests on a single report, so treat attribution and counts as provisional.

Why connected apps are a risk

A connected app holds a token that acts for the vendor inside your system. If the vendor is compromised, the token comes with it. You can have strong controls on your own users and still lose data this way. See also the Salesloft Drift OAuth incident.

A review checklist

1. List every connected app in your CRM and other core SaaS, with owner, purpose and date of last use.
2. Remove apps nobody can justify.
3. Restrict each app to the IP ranges the vendor publishes, where the platform allows it.
4. Reduce scopes to what the integration actually needs, and prefer read only.
5. Review logs for API activity from IP addresses outside those ranges and for large exports.
6. Know how to revoke and rotate tokens in minutes, and who is allowed to do it.
7. Decide in advance how you will pause an integration while a vendor investigates.
8. Ask each vendor how it stores and rotates the tokens it holds for you.

The recommended steps in the report also include enforcing conditional access and device trust checks for connected apps, rotating keys tied to the integration, and reauthorizing affected integrations once guidance is confirmed.

What to tell leadership

The risk is concentration. One vendor token may reach customer records, contracts and support history. Treat the list of connected apps like a list of keys to the building.

Where Safeguard fits

Safeguard's asset discovery and compliance evidence automation can help you inventory the systems and vendors in play and keep a record of reviews. It does not replace the OAuth controls inside your CRM. A free scan is at gold.safeguard.sh/scan.

Quick check

Sources

• Recorded Future, The Salesforce and Gainsight security incident

Last reviewed: 19 October 2026.