Salesforce Lawsuit: Data Breach MDL, Trafficking, and AI Copyright

The Salesforce lawsuit landscape in 2025 and 2026 is dominated by a wave of data breach class actions tied to a hacking campaign that pulled customer data out of dozens of major companies using its CRM platform. Alongside those cases, the San Francisco cloud company is defending a revived sex trafficking suit over its former relationship with Backpage.com, an author copyright suit over AI training, an FMLA retaliation claim from a former consultant, and active patent litigation in Texas. Other matters, including an ERISA 401(k) case, have already settled.

The 2025 Data Breach Class Actions

Starting in mid-2025, a hacking group known as ShinyHunters ran a voice-phishing campaign against employees at companies that use Salesforce’s CRM software. Employees were tricked into downloading a malicious replica of Salesforce’s Data Loader application, and the attackers used that access to pull customer records out of company databases. Affected organizations include Farmers Insurance, TransUnion, Allianz Life, Louis Vuitton, Adidas, Qantas, Chanel, Pandora, Google, Workday, Jaguar Land Rover, Stellantis, and Grubhub.¹

The stolen information included names, addresses, dates of birth, driver’s license numbers, and partial Social Security numbers. By September 2025, Salesforce faced at least 14 lawsuits, and by late August 2025, 48 federal class actions were pending across six district courts.¹²

A parallel attack vector ran through the Drift application published by Salesloft. On August 28, 2025, Salesforce disabled all integrations between its platform and Salesloft technologies after finding unauthorized access through Drift’s connection credentials. Cybersecurity firm Mandiant validated the investigation, and the Drift app remains disabled as of mid-2026.³⁴

The complaints allege negligence, breach of implied contract, breach of fiduciary duty, invasion of privacy, unjust enrichment, and violations of state and federal consumer protection laws. Plaintiffs describe a “hub-and-spoke” theory: Salesforce is the hub whose credentialing and OAuth app security gaps let hackers reach the spoke companies where the data actually lived.²

Salesforce’s Position

Salesforce has said its own platform was never compromised and characterizes the attacks as social engineering against individual customers rather than exploitation of any vulnerability in its software.⁵ The company has refused to pay ransom demands and says it has hardened security for connected applications, advised administrators to audit and disable unused apps, and enabled API access controls.¹

The JPML Decision and the TransUnion MDL

Plaintiffs asked the U.S. Judicial Panel on Multidistrict Litigation to consolidate all the breach cases into a single Salesforce-wide MDL in the Northern District of California. On December 16, 2025, the panel declined, finding consolidation unnecessary for the convenience of the parties or judicial efficiency. Salesforce and its co-defendants had unanimously opposed the request.⁶

The panel did consolidate 54 lawsuits targeting TransUnion into a separate MDL (No. 3170) in the Northern District of Illinois, before Senior District Judge Robert Gettleman. The TransUnion breach alone affected roughly 4.4 million customers, and as of June 2026 the MDL had 63 pending actions out of 67 filed.⁶⁷ The panel added that if discovery of Salesforce becomes necessary inside the TransUnion litigation, it “can be handled informally.”

Individual Cases Worth Tracking

Farmers Insurance: A California federal class action by plaintiff Malcolm Scott alleges Salesforce failed to secure its systems, exposing data belonging to more than 1.1 million customers. The breach was discovered on May 29, 2025. Farmers is offering affected customers 24 months of free identity monitoring.⁸⁹
Louis Vuitton: A proposed class action in the Southern District of New York by plaintiff Adriana Winkler alleged the luxury brand ignored specific warnings Salesforce published in March 2025 about social engineering threats and a June 2025 advisory from Google’s Threat Intelligence Group. The breach occurred June 7, 2025; U.S. customers were not notified until August 22, 2025. Claims against Louis Vuitton, Salesforce, and Qantas were dismissed without prejudice on January 21, 2026.¹⁰
Allianz Life: Multiple class actions were filed in the District of Minnesota starting in late July 2025 over a breach affecting roughly 1.4 million people. As of June 2026, at least 27 actions were pending before a single judge on a defendant-specific basis.¹¹⁶
Workday: Plaintiffs Juan Elias and Saroj Panigrahy sued in the Northern District of California (Case No. 3:26-cv-00725), alleging Salesforce and Workday failed to implement fundamental security measures despite prior warnings. The case is active with a jury demand.¹²

G.G. v. Salesforce: The Backpage Trafficking Case

On a separate track, Salesforce faces claims under the Trafficking Victims Protection Reauthorization Act for its former business relationship with Backpage.com, the classified advertising site federal authorities seized in 2018. G.G. v. Salesforce.com, Inc., filed in 2020 in the Northern District of Illinois, alleges Salesforce provided customized CRM software and personalized support to Backpage, effectively participating in a “venture” that facilitated trafficking.¹³

Judge Andrea R. Wood dismissed the complaint in May 2022, ruling Salesforce was protected by Section 230 of the Communications Decency Act and that the plaintiff had failed to allege Salesforce knew of the specific trafficking of the individual victim. The Seventh Circuit reversed on August 3, 2023, holding that Salesforce’s “continuous business relationship” with Backpage, which included at least five meetings between November 2013 and April 2017, was enough to show participation in a venture. The appellate court also held that Salesforce did not need to know about the trafficking of any specific victim, finding it plausible the company “should have known” of Backpage’s trafficking activity because U.S. Attorneys General and the National Association of Attorneys General had identified Backpage as a trafficking hub as early as 2008.¹⁴

Back in the district court, Chief Judge Virginia M. Kendall denied Salesforce’s motion to dismiss the federal trafficking claim on January 7, 2026, finding evidence that Salesforce was concerned about Backpage’s potential criminal liability. She did dismiss the plaintiffs’ claim under Masha’s Law (18 U.S.C. § 2255), which requires knowledge of harm to a specific plaintiff.¹³ In March 2026, Judge Kendall paused the civil litigation, ruling the cases must wait until the related criminal proceedings against Backpage’s founder and former executives are resolved.¹⁵

AI Copyright Suit

In October 2025, two authors sued Salesforce in the Northern District of California, alleging “massive copyright infringement” through the use of pirated copies of their books to train Salesforce’s artificial intelligence models. The plaintiffs are represented by the Joseph Saveri Law Firm, which has brought similar AI training suits against other technology companies. The complaint also names Anthropic as a related entity.¹⁶

FMLA Retaliation Suit

In April 2026, former Salesforce consultant Jeremy John sued in the U.S. District Court for the District of Connecticut (John v. Salesforce, Inc., No. 3:26-cv-00636), alleging he was fired in retaliation for taking FMLA leave to care for his father, who had cancer. The complaint alleges that while John was on approved leave, Salesforce “engaged atypically” with one of his clients to build a negative performance record. On his return, he says the company failed to give him work assignments and eventually terminated him, citing “lack of work” and a “poor performance rating” that John disputes, noting he had exceeded his goals the prior year. The suit brings claims under the ADA and FMLA and seeks compensatory and punitive damages with a jury trial. The case is pending.¹⁷¹⁸

Patent Cases

In VE Opening LLC v. Salesforce Inc. (W.D. Tex., No. 7:25-cv-00539), filed in November 2025, Magistrate Judge Derek Gilliland issued a report and recommendation on June 9, 2026, finding Claim 1 of U.S. Patent No. 9,916,079 ineligible for patent protection while allowing Claims 4, 5, and 6 to proceed. Discovery is ongoing.¹⁹²⁰ A separate suit by WSOU Investments, which accused Salesforce of infringing a caller ID patent (U.S. Patent No. 7,551,731) through its AI software products, was permanently dismissed by stipulation in May 2025.²¹

Recently Resolved Matters

Salesforce closed out its long-running 401(k) litigation in early 2025. Two consolidated class actions, Miguel v. Salesforce.com Inc. (2020) and Simonelli v. Salesforce.com Inc. (February 2024), alleged fiduciaries breached their duties by keeping underperforming funds and letting the plan pay excessive recordkeeping and investment fees. A $1.35 million settlement received final court approval on April 4, 2025, covering participants in the Salesforce 401(k) Plan between March 11, 2014, and October 11, 2024.²²²³ An earlier related case, Davis v. Salesforce.com, Inc., had reached the Ninth Circuit, which in April 2022 reversed the dismissal of the ERISA excessive-fee complaint while upholding the dismissal of one claim.²⁴

An older employment case, Anderson v. Salesforce.com Inc. (N.D. Cal., No. 18-cv-06712), was filed in November 2018 by former employee Stephen Anderson, who alleged racial discrimination, retaliation for whistleblowing about accounting practices, and disability discrimination. In December 2018, Judge Phyllis J. Hamilton ordered the case to arbitration under an agreement Anderson signed in 2015, staying only his Sarbanes-Oxley whistleblower claim.²⁵

Securities Investigation

After Salesforce’s fiscal first-quarter 2025 earnings report on May 29, 2024, in which revenue of $9.13 billion missed the midpoint of the company’s own guidance and a key bookings metric fell below expectations, the stock dropped more than 20%. Levi & Korsinsky began investigating potential violations of federal securities laws and recruiting lead plaintiffs for a possible class action.²⁶

1
SalesforceBen. Salesforce Data Theft Roundup: Everything You Need to Know
2
GovInfo. USCOURTS JPML MDL 3164
3
Salesforce Trust. Salesforce Trust Status – Salesloft Drift Incident
4
Salesforce Help. Salesforce Security Response: Drift App Incident
5
Salesforce Trust. Salesforce Trust Status – Social Engineering Advisory
6
JPML. MDL 3164 and MDL 3170 Transfer Order
7
MDL Update. Trans Union LLC Data Security Breach Litigation
8
Top Class Actions. 1.1 Million Farmers Insurance Customers Hit by Data Breach Linked to Salesforce Hack
9
ForThePeople. Salesforce Sued Over Data Breach Affecting 1 Million Farmers Insurance Customers
10
SalesforceBen. Salesforce Data Breach Was Highly Preventable, Louis Vuitton Lawsuit Claims
11
Forbes. Class Actions Brought Against Allianz Over Data Breach
12
Top Class Actions. Workday, Salesforce Class Action Claims Companies Failed to Protect Consumer Data
13
FindLaw. Illinois Court: Salesforce Backpage Trafficking Suit Can Go Forward
14
UNODC Case Law Database. G.G. and Deanna Rose v. Salesforce.com Inc.
15
Law360. Salesforce Wins Stay of Backpage Trafficking Cases in Illinois
16
Law360. Authors Say Salesforce Used Pirated Books to Train Its AI
17
Bloomberg Law. Salesforce Worker Allegedly Laid Off for Taking Care of Father
18
HR Dive. Salesforce Negative Record Employee FMLA Leave
19
Bloomberg Law. Salesforce Should Face Some VE Opening Patent Claims, Judge Says
20
CourtListener. VE Opening LLC v. Salesforce Inc. Docket
21
Law360. Licensing Co. Ends Caller ID Patent Suit Against Salesforce
22
NAPA-Net. Salesforce Finally Settles Years-Long 401(k) Suit
23
Salesforce ERISA Settlement. Salesforce ERISA Class Action Settlement
24
U.S. Chamber of Commerce. Davis v. Salesforce.com Inc.
25
Bloomberg Law. Salesforce Job Bias, Retaliation Case Sent to Arbitration
26
Levi & Korsinsky. Salesforce Inc. Class Action Lawsuit (CRM)