Ethical Hacking News
Salesforce is facing a wave of class-action lawsuits over a data breach that exposed customer data. The breach, allegedly facilitated by an unauthorized third party, saw sensitive information stolen from the Drift app, compromising personal information of millions. Salesforce has denied any shortcomings in its systems, but numerous filings have suggested otherwise.
Salesforce is facing class-action lawsuits due to a series of data breaches that exposed customer data.The breaches were allegedly facilitated by an unauthorized third party that gained access to Salesforce's system through the GitHub of Salesloft.Nearly 4.5 million individuals and over a million customers had their personal information compromised in the breaches.Salesforce has denied any shortcomings in its systems, claiming it was not compromised, but numerous filings suggest otherwise.Class-action lawsuits have been filed against Salesforce's customers, including TransUnion, Allianz Life Insurance, and Farmers Insurance, alleging financial losses due to identity theft.Google Threat Intelligence Group confirmed that several breaches occurred between May and summer 2025, potentially caused by the Salesloft breach.
Salesforce, a leading Customer Relationship Management (CRM) software provider, is currently facing a wave of class-action lawsuits stemming from a series of data breaches that exposed customer data. The breach, which occurred in July 2025, was allegedly facilitated by an unauthorized third party that gained access to Salesforce's system through the GitHub of Salesloft, a third-party sales engagement platform.
The breach itself saw the theft of sensitive information, including OAuth tokens, from the Drift app, which is integrated with Salesforce. The attackers allegedly used these stolen tokens to gain access to Salesforce data, compromising the personal information of nearly 4.5 million individuals in one instance and over a million customers in another case involving Farmers Insurance.
In response to the breach, Salesforce has denied any shortcomings in its systems, claiming that its platform was not compromised. However, numerous filings by individuals and organizations have suggested otherwise. The claims, many of which aim for class action status, allege that the personal information stolen during the attack is making the complainants vulnerable to identity theft.
One such case, led by Staci Johnson, accuses Salesforce of failing to properly secure her personally identifiable information (PII) in connection with a data breach in July 2025. The claim calls for Salesforce to "disclose the nature of the information that has been compromised and to adopt sufficient security practices and safeguards to prevent incidents… in the future."
In another instance, Google Threat Intelligence Group confirmed that several breaches occurred between May and summer 2025, where attackers stole OAuth tokens from the third-party Salesloft Drift app. This confirms the earlier reports of a breach at Salesloft, which led to the theft of sensitive information.
The breach has also seen Salesforce facing class-action lawsuits against its customers, including TransUnion, Allianz Life Insurance, Farmers Insurance, Workday, and Pandora Jewelry. The plaintiffs in these cases are alleging that they suffered financial losses due to identity theft, and are seeking compensation and injunctive relief to improve Salesforce's system security.
In a related development, Google has stated that the data breach may have been caused by the Salesloft breach, suggesting that Salesforce might be at fault for not properly securing its systems. However, Salesforce has maintained that its platform was not compromised.
As the situation unfolds, it is clear that Salesforce is facing significant scrutiny over its security practices and protocols. The company's reputation as a leader in CRM software will likely be impacted by these events, and it remains to be seen how the company will respond to these allegations and take steps to improve its systems' security.
Related Information:
https://www.ethicalhackingnews.com/articles/Salesforce-Faces-Class-Action-Lawsuits-Over-Data-Breach-A-Complex-Web-of-Security-Shortcomings-ehn.shtml
https://go.theregister.com/feed/www.theregister.com/2025/09/26/salesforce_class_actions/
https://www.msn.com/en-us/money/companies/salesforce-facing-multiple-lawsuits-after-salesloft-breach/ar-AA1Nn1Sa
https://www.theregister.com/2025/09/26/salesforce_class_actions/
Published: Fri Sep 26 23:10:36 2025 by llama3.2 3B Q4_K_M
