Fake Gainsight / ChurnZero customer success platform subscription payment failed, customer health scores and renewal playbooks suspended, churn risk alerts disabled, or NPS surveys at risk phishing

Phishing emails impersonating Gainsight or ChurnZero claiming the customer success platform subscription payment has failed, customer health scores are suspended, renewal playbooks are disabled, churn risk alerts are no longer active, NPS surveys are paused, or customer journey analytics have been temporarily suspended — directing them to update billing or restore access through a credential-harvesting portal. A distinct attack category targeting customer success platforms where suspension blinds CS teams to at-risk accounts and breaks renewal workflows at the exact moment when quarterly business reviews are happening and renewals are due. Key facts: (1) Gainsight serves 1,000+ enterprise customers ($50,000-$500,000+/year depending on ARR under management) including Salesforce, Box, and SAP as the dominant customer success platform for enterprise SaaS and subscription businesses — Gainsight aggregates product usage data, support ticket data, CRM data, and NPS survey responses into unified customer health scores that drive CS team workflows; a Gainsight suspension makes every customer health score inaccessible and kills all automated playbook triggers — the churn risk playbook that was supposed to auto-assign a red-account CSM call stops firing, and red accounts in active churn risk continue toward cancellation without CS team intervention; (2) The 'customer health scores suspended' hook is acutely urgent for CS leadership: Gainsight's health scoring is the operational foundation of enterprise CS — a company managing 1,000 enterprise accounts worth $50K-200K each uses health scores to triage CSM time; losing health scores means the 50 accounts that were on the cusp of renewal decision cannot be identified and prioritized; at $100K average ARR, missing even 3 renewal conversations in a month due to suspended health score visibility is $300K in ARR at risk; (3) ChurnZero serves 1,000+ SaaS companies ($20,000-$100,000+/year) as the real-time customer success platform built around churn prevention — ChurnZero's core product is real-time churn risk scoring and alert generation; ChurnZero sends automated ChurnScore alerts when a customer's churn risk crosses a threshold, triggering a CSM action item; when ChurnZero alerts are suspended, the accounts that just crossed into high-risk status do not generate the alert that would prompt the CSM to schedule a call before the customer's renewal decision is finalized; (4) The 'renewal playbooks disabled' hook targets a time-sensitive workflow: Gainsight playbooks are automated step-by-step action plans that CSMs follow for renewals, expansions, and at-risk saves — a renewal playbook automatically creates CRM tasks, email templates, and success planning meeting invites 90 days before renewal; disabling playbooks for accounts renewing in the next 30 days means those renewal conversations have no structured follow-through; (5) Gainsight and ChurnZero credentials expose the complete customer health and retention intelligence: every customer's health score trend, product usage depth, NPS history, and support ticket frequency — plus the internal renewal probability scores and the playbook history showing which save plays were tried and whether they worked. Warning signs: sender not gainsight.com or churnzero.com; genuine Gainsight billing at app.gainsightcloud.com/account/billing; ChurnZero billing at app.churnzero.net/account/billing.