Topic starter
01/12/2025 3:08 pm
TL;DR: Threat actors compromised third-party OAuth tokens tied to Gainsight applications, then used those non-human identities to access Salesforce customer instances and drive exfiltration activity, according to Astrix Security. The breach shows that app-to-app trust and persistent integration access remain weak points when lifecycle controls and visibility lag behind SaaS sprawl.
Editorial analysis by NHI Mgmt Group, based on content published by Astrix Security: “Salesforce Revokes Gainsight App Tokens: Latest OAuth Supply Chain Breach”.
Key questions
Q: What breaks when a third-party OAuth app is compromised?
A: A compromised OAuth app inherits whatever delegated scopes users already approved, so the attacker can act through legitimate tokens instead of noisy intrusion methods.
Q: Why do SaaS-to-SaaS compromises create such a large blast radius?
A: Because a single trusted integration often connects multiple business systems, one stolen token can inherit access across several services.
Q: What are the signs that OAuth token abuse is happening inside a SaaS environment?
A: Common warning signs include token use outside normal business hours, large bursts of SOQL or API queries, repeated searches for passwords or API keys, and deletion of query logs.
Practitioner guidance
- Revoke and reissue delegated access Identify every Gainsight-published token, refresh token, and related integration credential, then disable the associated integration users before restoring service on a reviewed basis.
- Map the full SaaS trust graph Trace where the affected integration connected into Salesforce, Slack, Entra ID, Google Workspace, and browser extensions so you can close every downstream access path, not just the original app.
- Reduce permissions on connected apps Review every third-party integration for least privilege, then remove permissions that are not required for the app’s current function or operating owner.
Bottom line: The breach exposes a recurring weakness in SaaS governance: third-party integrations are often trusted for long periods without enough ownership or review.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 10 months ago by Abdelrahman
This topic was modified 5 days ago by NHI Mgmt Group
06/10/2026 5:01 pm
Third-party OAuth trust is now a first-class identity control surface: The breach works because integrations are trusted as durable actors rather than governed credentials with lifecycle boundaries. Once a token is issued, the app can keep operating long after ownership, intent, or risk has changed. Practitioners should treat every external integration as an NHI with an accountable owner and a revocation path.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What should organisations do when a third-party NHI is no longer trusted?
A: They should revoke access, disable related integration users, rotate any shared secrets, and confirm that no secondary apps still depend on the same trust relationship. Offboarding must be treated as a complete lifecycle event, not a single token revocation step.
👉 Read our full editorial: Salesforce Gainsight token breach exposes NHI governance gaps