Do Salesforce Customers Have a Security Problem?

Key Takeaways

• ShinyHunters breached multiple Salesforce customers, demanding ransom
• Human error and permissive org settings drive most incidents
• Salesforce’s shared responsibility model places security burden on clients
• New ISV mandates require PKCE, token rotation, and IP allowlists
• AI integration heightens need for strict access controls in Salesforce

Pulse Analysis

The past year has seen a cascade of high‑impact data breaches affecting Salesforce‑hosted customer data. Threat group ShinyHunters has compromised dozens of organizations—including Grubhub, Loblaw, Hallmark and even Google—exposing names, addresses, credit‑card numbers and other personal identifiers. While Salesforce insists no platform vulnerability is to blame, investigations point to overly permissive user permissions, mis‑configured org settings and social‑engineering tactics such as vishing. These human‑error vectors have turned otherwise robust cloud infrastructure into an open door, underscoring the practical limits of the vendor’s shared‑responsibility model.

In response, Salesforce has rolled out a series of mandatory security upgrades for Independent Software Vendors (ISVs) that must be in place by April 13. The changes demand PKCE implementation, refreshed token handling, frequent token rotation, static IP allow‑lists and continuous monitoring for anomalous activity. For customers with dedicated development teams, the code modifications are straightforward, but smaller firms risk falling behind due to limited resources. The onus now lies on organizations to audit permission sets, enforce multi‑factor authentication, and adopt least‑privilege principles before the new controls become the baseline.

Looking ahead, the rapid rollout of AI‑driven features such as Agentforce expands the attack surface of Salesforce environments. An IBM study found that 13 % of firms suffered breaches of AI models, with almost all lacking proper access controls. As enterprises embed generative AI into sales and service workflows, mis‑configured APIs or exposed model endpoints could become lucrative targets. Continuous security education, automated policy enforcement, and regular penetration testing will be essential to keep pace with evolving threats. Ultimately, a collaborative security posture—where Salesforce provides clear guidance and customers execute disciplined governance—will determine whether the platform remains a trusted backbone for digital transformation.