Battered by cyberattacks, Salesforce faces a trust problem - and a potential class action lawsuit

Follow ZDNET: Add us as a preferred source on Google. Since Salesforce's founding in 1999, the company's executive team has made trust the top priority for the organization and its employees. In a post titled "Trust is our #1 value," the company states that "our trust-first culture is based on ensuring that our customers know their data is safe, and theirs -- to be accessed when, where, and how they intend." However, recent data thefts involving Salesforce's infrastructure suggest that the cloud company is encountering avoidable difficulties in delivering on that promise. Also: Your passkeys could be vulnerable to attack, and everyone - including you - must act ZDNET's research reveals that Salesforce could be doing more to secure the parts of its platform that were exploited in recent attacks. In preparing this report, I interviewed Salesforce chief trust officer Brad Arkin as well as cybersecurity experts from AppOmni, Google Cloud Mandiant, and Okta. (Okta's brand was hijacked in some versions of the attacks in question, but Okta's platform itself was not a part of those attacks.) For Salesforce customers, 2025 has been a particularly brutal year.  A long (and growing) list of organizations -- many of which are household names -- have reported massive and malicious exfiltrations of sensitive customer data followed by demands for cryptocurrency ransoms. While several companies have openly cited their instances of Salesforce as the targets of these attacks, others have coyly...