7-Eleven Confirms Data Breach After ShinyHunters Ransom Demand
Summary
7-Eleven says an April 8 intrusion into systems storing franchisee documents exposed unspecified personal information. ShinyHunters separately claimed 600,000+ Salesforce records and demanded a ransom; the company reported two affected Maine residents.
Key points
- 7-Eleven detected an intrusion on April 8 into systems used to store franchisee documents.
- A notice submitted to Maine’s attorney general said unspecified personal information provided during franchise applications was compromised.
- 7-Eleven reported that two Maine residents were affected but did not disclose the total number of impacted individuals.
- ShinyHunters listed 7-Eleven on its leak site on April 17 and claimed to have stolen more than 600,000 Salesforce records; the claim is attributed to the group.
- The group threatened to leak the data unless a ransom was paid by April 21, then offered the data for sale for $250,000 on a hacker forum.
- The article says ShinyHunters and affiliated actors have targeted Salesforce instances since mid-2025 through phishing, third-party integration abuse, or misconfigurations, rather than Salesforce product vulnerabilities.
Article Details
- Victim Organization
- 7-Eleven
- Incident Type
- Data breach involving an intrusion into systems used to store franchisee documents.
- Data Types Exposed
- Unspecified personal information provided during franchise applications
- Personal information and corporate data (claimed by ShinyHunters)
- Affected Records
- 7-Eleven did not disclose the total number of affected individuals; it reported that two Maine residents were impacted. ShinyHunters claimed to have stolen more than 600,000 Salesforce records.
- Ransom Or Extortion
- ShinyHunters threatened to leak the data unless a ransom was paid by April 21, then offered to sell the allegedly stolen data for $250,000. The source does not report that a ransom was paid.
- Claim Status
- confirmed