Salesforce Customers Hit by Large-Scale Data Theft Operation

Post Views: 1

Salesforce Customers Targeted by ShinyHunters Cybercrime Group

A new wave of data theft and extortion has been unleashed by the notorious ShinyHunters cybercrime group, targeting hundreds of Salesforce customers.

Attack Details

According to Salesforce, the attacks began in mid-2025, leveraging social engineering tactics and exploiting misconfigurations to compromise sensitive data.

According to Salesforce, the issue is not due to a vulnerability in its platform, but rather a customer-configured setting that has been exploited by the threat actor.

The attackers have modified an open-source tool called Aura Inspector, originally developed by Mandiant for auditing Salesforce Aura instances, to extract data from vulnerable sites.

ShinyHunters Claims Responsibility

ShinyHunters has claimed responsibility for the attack, boasting that they have targeted “several hundreds of companies” as part of the “Salesforce Aura Campaign.”

The group has threatened to release stolen data if their extortion demands are not met.

Causes of the Breach

Salesforce has confirmed that the data breaches were the result of phishing, abuse of third-party integrations, or misconfigurations, rather than vulnerabilities in its products or systems.

The company has advised customers to review their guest user settings and ensure that they are not overly permissive.

ShinyHunters’ History of Attacks

The ShinyHunters group has a history of targeting high-profile organizations and leaking sensitive data.

In 2025, the group was responsible for compromising millions of data records, which were subsequently leaked online.

Prevention and Protection

The latest campaign highlights the importance of proper configuration and security measures in preventing data breaches.

Organizations using Salesforce are advised to take immediate action to review their settings and ensure that they are not vulnerable to similar attacks.

The incident also underscores the need for customers to be vigilant and proactive in protecting their data.

By taking steps to secure their Salesforce instances, organizations can reduce the risk of data breaches and extortion attempts.