The first entry is always the pin's source. Overall confidence is a weighted average of how firmly each reference supports the start and end times used above; a reference counts half as much for every 180 days older than the newest.
Gainsight's[3][4] incident timeline (PST): 'November 19, 2025 - Afternoon Salesforce notifies Gainsight of unusual activity involving the Gainsight Salesforce Connected App'; The Register[5] says Salesforce announced the revocation on Wednesday, 19 November.
FINRA says Salesforce confirmed unauthorised access to customer data between 23 October and 19 November 2025 through compromised Gainsight[1][3][4] connections.
Salesforce reconnected Gainsight[1][4] on 10 December 2025 after fixes validated by Mandiant and CrowdStrike.
Gainsight's[1][3] CEO says only a handful of customers had data affected and the Salesforce connection was offline while Mandiant investigated.
ShinyHunters told The Register it had access to Gainsight[1][3][4] for nearly three months after the Drift hack; Zendesk and HubSpot also cut Gainsight's connectors.
Something missing or wrong? Say it in your own words: a link that backs this pin up, a different start or end date and why, or a fact it lacks or gets wrong. The AI checks it against this pin's sources, searches for better ones, and adds any page that backs you up. The pin's own sources still count most.
