Mandiant: upcoming dates

Recent

• Cybersecurity09/23/2026@CyberDesk

  Amazon Elects Mandiant Founder Kevin Mandia to Its Board

  Amazon.com Day 1, 2121 7th Avenue, Belltown, Seattle, WA 98121, United StatesAmazon

  

  Starts 09/08/2026CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins85% CONFIDENCEOverall confidence: 85%How well the pin's source and references back up its dates.Weighted average of how firmly 6 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better25 days agoAmazon's announcement says Mandia "was elected to Amazon's Board of Directors on September 8", and its 8-K reads "On September 8, 2026, the Board of Directors of Amazon.com, Inc. ... elected Kevin R. Mandia as a director".^[1]

  Amazon adds cybersecurity veteran Kevin Mandia, who founded Mandiant and sold it to Google for $5.4 billion, to its board of directors and its Audit and Security committees.

  00
• Cybersecurity09/24/2026@CyberDesk

  Salesforce Warns of Mass Theft From Misconfigured Experience Cloud Sites

  Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce

  

  Starts 03/07/2026 10:48PM UTCCONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins85% CONFIDENCEOverall confidence: 85%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better210 days agoSalesforce^[1] Security's post is dated 'March 7, 2026' (published 22:48 UTC); FINRA^[2]: 'On March 7, 2026, Salesforce reported that ShinyHunters was actively exploiting misconfigured Experience Cloud guest user profiles.'

  Salesforce said a known threat group was mass-scanning public Experience Cloud sites with a modified Mandiant tool and pulling CRM data through overly permissive guest user profiles.

  00
• Cybersecurity09/24/2026@CyberDesk

  Salesforce Cuts Off Gainsight Apps After Suspicious Access to Customer Data

  350, Bay Street, Fisherman's Wharf, North Beach, San Francisco, California, 94133, United StatesGainsight

  

  Starts 11/19/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins88% CONFIDENCEOverall confidence: 88%How well the pin's source and references back up its dates.Weighted average of how firmly 6 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better318 days agoGainsight's^[1][3][4] incident timeline (PST): 'November 19, 2025 - Afternoon Salesforce notifies Gainsight of unusual activity involving the Gainsight Salesforce Connected App'; The Register^[5] says Salesforce announced the revocation on Wednesday, 19 November.

  Salesforce revoked every token held by Gainsight-published apps and pulled them from the AppExchange after spotting API calls from unrecognised IPs into customers' Salesforce data.

  00
• Cybersecurity09/24/2026@CyberDesk

  Hackers Use Stolen Salesloft Drift Tokens to Raid Salesforce Instances

  Atlanta, Fulton County, Georgia, United StatesSalesloft

  

  08/08/2025 - 08/18/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins87% CONFIDENCEOverall confidence: 87%How well the pin's source and references back up its dates.Weighted average of how firmly 5 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better1.2 years agoGTIG: 'Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft^[2] Drift third-party application.'

  Using OAuth tokens stolen from Salesloft's Drift chatbot, the UNC6395 crew exported data from hundreds of companies' Salesforce instances, hunting support cases for AWS keys, passwords and Snowflake tokens.

  00