Over the past week, a wave of Salesforce-related hacking attacks has hit companies like Chanel, Qantas, Adidas, Victoria’s Secret, and even Google.
The main tactic? Hackers tricking staff into installing fake apps—most notably a counterfeit “Data Loader” tool—which gave them access to sensitive Salesforce data.
In response to the Google breach, Salesforce reminded customers to review their security best practices, including multi-factor authentication (MFA), least privilege access, and careful management of connected apps.
Think of it this way: Salesforce is like a landlord. They provide the building, locks, and security guidance—but if tenants leave their doors unlocked, there’s only so much Salesforce can do.
What this means for your organisation
A Salesforce data breach could:
- Severely damage your reputation.
- Put constituents at risk, especially if you collect sensitive information.
- Disrupt operations and expose you to legal and regulatory action.
The most important step
Be very selective about who gets System Administrator access. Only give this profile to people you absolutely trust, who have proven Salesforce knowledge and experience.
A non-disclosure agreement won’t help if an inexperienced admin is tricked into installing malicious software. One mistake could expose all of your Salesforce data.
Four actions you must take
- Apply least privilege – give users only the access they need.
- Use MFA and password managers for all logins.
- Audit user access and integrations regularly.
- Train staff and volunteers on data handling and phishing awareness.
It sounds easy, but sometimes we can’t find the time to do everything on our to-do list. Keeping your supporters’ trust starts with keeping their data safe. If you’d like guidance on securing Salesforce for your organisation, please contact us — we’re here to help!
