{"id":20000224,"subject":"Security Advisory: Ongoing Response to Social Engineering Threats","body":"We are aware of recent extortion attempts by threat actors, which we have investigated in partnership with external experts and authorities. Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support. At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology.\nOur security teams are actively working to protect customer environments and data, providing guidance and support. Customers identified as potentially affected have been notified directly. If you have not received a notification, we currently have no evidence suggesting any impact to your account. We continue to monitor the situation closely and encourage customers to remain vigilant against phishing and social engineering attempts, which remain common tactics used by threat actors.\n\nFor guidance, please review our blog post (https://www.salesforce.com/blog/protect-against-social-engineering), knowledge article (https://help.salesforce.com/s/articleView?id=005226734&type=1), and reach out through the Salesforce Help portal if you need support.","incidentId":null,"publicView":true,"startDate":"2025-10-02T14:50:00.000Z","endDate":"2026-09-30T13:13:00.000Z","createdAt":"2025-10-02T15:58:29.023Z","updatedAt":"2026-09-30T13:16:53.075Z","externalId":null,"isVisibleWhenClosed":false,"isVisible":true,"informationalMessageType":"informationalMessage","status":"Resolved","timeline":[{"title":"Update","content":"Salesforce is monitoring social engineering campaigns targeting third-party identity providers (IdPs) across the industry. In these attacks, threat actors use fraudulent login pages or impersonate IT support through voice calls to steal credentials or MFA codes, or to trick users into authorizing malicious connected apps. If an IdP account is compromised, attackers may attempt to access connected applications.\n\nPlease note this issue does not stem from a vulnerability inherent to Salesforce; these attacks rely on social engineering and deceptive authentication prompts.\n\nOur security teams are actively working to protect customers and have notified potentially affected accounts. For guidance and mitigations, please review our blog post (https://www.salesforce.com/blog/protecting-salesforce-data-after-an-identity-compromise/) and knowledge article (https://help.salesforce.com/s/articleView?language=en_US&id=005226734&type=1). For support, contact Salesforce Customer Support via https://help.salesforce.com/s/?language=en_US.","createdAt":"2026-01-30T15:58:12.170Z","updatedAt":"2026-01-30T15:58:12.172Z","entryType":"informational_message_update","sourceId":20000402,"sourceType":"update"},{"title":"Security Advisory: Ongoing Response to Social Engineering Threats","content":"We are aware of recent extortion attempts by threat actors, which we have investigated in partnership with external experts and authorities. Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support. At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology.\nOur security teams are actively working to protect customer environments and data, providing guidance and support. Customers identified as potentially affected have been notified directly. If you have not received a notification, we currently have no evidence suggesting any impact to your account. We continue to monitor the situation closely and encourage customers to remain vigilant against phishing and social engineering attempts, which remain common tactics used by threat actors.\n\nFor guidance, please review our blog post (https://www.salesforce.com/blog/protect-against-social-engineering), knowledge article (https://help.salesforce.com/s/articleView?id=005226734&type=1), and reach out through the Salesforce Help portal if you need support.","createdAt":"2025-10-02T15:58:29.023Z","updatedAt":"2026-09-30T13:16:53.075Z","entryType":"informational_message_created","sourceId":20000224,"sourceType":"message"}],"productKeys":[],"InformationalMessageUpdates":[{"id":20000402,"message":"Salesforce is monitoring social engineering campaigns targeting third-party identity providers (IdPs) across the industry. In these attacks, threat actors use fraudulent login pages or impersonate IT support through voice calls to steal credentials or MFA codes, or to trick users into authorizing malicious connected apps. If an IdP account is compromised, attackers may attempt to access connected applications.\n\nPlease note this issue does not stem from a vulnerability inherent to Salesforce; these attacks rely on social engineering and deceptive authentication prompts.\n\nOur security teams are actively working to protect customers and have notified potentially affected accounts. For guidance and mitigations, please review our blog post (https://www.salesforce.com/blog/protecting-salesforce-data-after-an-identity-compromise/) and knowledge article (https://help.salesforce.com/s/articleView?language=en_US&id=005226734&type=1). For support, contact Salesforce Customer Support via https://help.salesforce.com/s/?language=en_US.","createdAt":"2026-01-30T15:58:12.170Z","updatedAt":"2026-01-30T15:58:12.172Z","GeneralMessageId":20000224}]}