4/1/2026 · 2 min read
salesforcedata-breachshinyhuntershallmarksecuritypii
Threat actor ShinyHunters has reportedly compromised 7.9 million Salesforce records from US conglomerate Hallmark, containing PII and internal corporate data. This breach is part of their ongoing campaign, with a deadline set for Hallmark to respond before the data is leaked.
This article details an ongoing campaign of data theft attacks targeting Salesforce customers in 2026, primarily exploiting "overly permissive" Experience Cloud guest user configurations. It chronicles numerous high-profile breaches and provides Salesforce's crucial security recommendations.
The ShinyHunters hacking group is threatening Salesforce customers, demanding payment to prevent the exposure of compromised data. This group, linked to recent Experience Cloud hacks, has given an ultimatum to businesses targeted via their Salesforce instances.
Facing widespread Salesforce security breaches, this article proposes five foundational principles for customers to proactively transform their security posture by 2026, shifting focus from reactive technical fixes to a continuous, community-driven approach.