4/5/2026 · 3 min read
salesforcesecuritydata-breachexperience-cloudguest-usershinyhunters
This article details an ongoing campaign of data theft attacks targeting Salesforce customers in 2026, primarily exploiting "overly permissive" Experience Cloud guest user configurations. It chronicles numerous high-profile breaches and provides Salesforce's crucial security recommendations.
Sources & Further Reading
The ShinyHunters hacking group is threatening Salesforce customers, demanding payment to prevent the exposure of compromised data. This group, linked to recent Experience Cloud hacks, has given an ultimatum to businesses targeted via their Salesforce instances.
Threat actor ShinyHunters has reportedly compromised 7.9 million Salesforce records from US conglomerate Hallmark, containing PII and internal corporate data. This breach is part of their ongoing campaign, with a deadline set for Hallmark to respond before the data is leaked.
Facing widespread Salesforce security breaches, this article proposes five foundational principles for customers to proactively transform their security posture by 2026, shifting focus from reactive technical fixes to a continuous, community-driven approach.