ShinyHunters Claims Salesforce Experience Cloud Data Theft at About 400 Organizations
Summary
ShinyHunters claims it accessed data from about 400 organizations through misconfigured Salesforce Experience Cloud portals and threatens leaks. Salesforce attributes the activity to customer settings; the group disputes that account.
Key points
- ShinyHunters claims to have accessed records from roughly 400 organizations and threatens to leak them unless its extortion demands are met.
- The reported targets were Salesforce Experience Cloud portals with overly permissive guest-user settings; attackers allegedly used a modified Aura Inspector to find them.
- The article says the allegedly accessed data included names and phone numbers, which have been used in vishing attacks.
- Salesforce says the activity involves customer-configured guest-user settings, not a flaw in its platform.
- ShinyHunters disputes Salesforce’s explanation and claims it can bypass restrictions; the article says this has not been independently confirmed.
- Salesforce recommends least-privilege guest access, private-by-default data settings, and disabling public APIs.
Article Details
- Event Type
- Reported data breach and extortion campaign targeting Salesforce Experience Cloud customer portals.
- Impact
- ShinyHunters claims to have accessed records from roughly 400 organizations and threatens to leak the data unless its demands are met. The reported stolen information includes names and phone numbers, which the article says have been used in vishing. Salesforce says the activity resulted from customer-configured guest-user settings, while ShinyHunters claims it can bypass restrictions even on properly secured sites; that claim has not been independently confirmed.