Salesforce controversies
Controversies tied to this brand in public sources. A listing is not a finding of fault.
Back to profile4 entries
2026
AU Small Finance Bank investigates potential data leak
Issue disclosure
AU Small Finance Bank stated that it was investigating a potential data leak involving a Salesforce-hosted platform holding limited vehicle-loan customer data. The investigation followed a claim by the hacker group ScarlettGroup that it had breached the lender and a threat to leak customer and corporate data. The bank said its own systems were unaffected and that banking services were operating normally. The reported breach was not established as confirmed.
AU Small Finance Bank said it was investigating a potential data leak involving a Salesforce-hosted platform with limited vehicle-loan customer data, after hacker group ScarlettGroup claimed to have breached the lender and threatened to leak customer and corporate data. The bank said its own systems were unaffected and banking services were operating normally; the reported breach was not established as confirmed.
Company response
Investigation — AU Small Finance Bank
AU Small Finance Bank is investigating a “potential data leak” linked to a third-party Salesforce platform holding limited vehicle loan details, the lender told Moneycontrol on October 30.
Clarification — AU Small Finance Bank
We reaffirm that the bank’s own systems remain unaffected and all banking services are operating normally.
Source excerpt
The probe follows claims by hacker group ScarlettGroup that it breached the lender and would leak sensitive customer records and internal corporate data.
We reaffirm that the bank’s own systems remain unaffected and all banking services are operating normally.
AU Small Finance Bank is investigating a “potential data leak” linked to a third-party Salesforce platform holding limited vehicle loan details, the lender told Moneycontrol on October 30.
2025
Political statements and immigration-enforcement controversy
Marc Benioff’s public support for Donald Trump and his call for National Guard deployment in San Francisco generated criticism from local political figures and was followed by an apology for the National Guard comments. Reports that Salesforce presented AI-related ideas to support Immigration and Customs Enforcement’s staffing and deportation operations created additional controversy concerning the use of enterprise technology in government enforcement.
2020
Class action filed over Hanna Andersson customer data breach
Lawsuit filed
Plaintiff Bernadette Barnes filed a class action complaint against Salesforce and Hanna Andersson, alleging negligence and violations of California's unfair competition law in connection with a customer data breach. The complaint alleged that malware on Hanna Andersson's e-commerce platform scraped customer information and that the companies inadequately protected user information.
Source excerpt
Hanna Andersson’s investigation revealed that Salesforce Commerce Cloud’s e-commerce platform was infected with malware that scraped customer information.
Hanna Andersson notified customers about a data breach that occurred from September 16, 2019 to November 11, 2019.
2020
The Privacy Collective brings GDPR claims against Oracle and Salesforce
Lawsuit filed
The Privacy Collective brought class action claims against Oracle and Salesforce in Dutch, English and Welsh courts, alleging that their processing and sharing of personal data collected by third-party cookies for targeted advertising breached the GDPR. Oracle denied the claims and said it would defend against them; Salesforce also disputed the allegations and said it intended to demonstrate they were without merit.
Company response
Denial — Oracle
Oracle will vigorously defend against these baseless claims.
Denial — Salesforce
Salesforce disagrees with the allegations and intends to demonstrate they are without merit.
Source excerpt
The cases are being brought by The Privacy Collective, a non-profit foundation set up for the purpose, and centre on the use of third-party cookies to support dynamic ad pricing for targeted online advertising.
The lawsuit claims that the collection and sharing of this data by Oracle and Salesforce is being done without clear consent and therefore goes against GDPR, and in fact has been in breach of the regulations since they came into force.
The Dutch action will be the largest-ever class action in the Netherlands over GDPR and is being led by Amsterdam-based law firm Bureau Brandeis. The case to be filed in England and Wales in September 2020 will be led by City of London practice Cadwalader.