A cyber criminal group known as ShinyHunters has claimed responsibility for breaching roughly 100 high-profile companies in its latest assault on Salesforce customers, adding pressure on enterprises relying on the widely-deployed CRM platform. The group claims to have stolen data from about 100 high-profile companies in its latest Salesforce customer data heist, including Salesforce itself.
Among the claimed victims are Snowflake, Okta, Lastpass, Salesforce itself, Sony, AMD, and a lot more, according to statements made to The Register. The attackers said that the recon and exploitation has been going on for several months now. This marks the latest in a relentless series of attacks on Salesforce customers that has accelerated through 2025 and into 2026.
The campaign's technical mechanics reveal a concerning abuse of defensive security tools. The miscreants are using a modified version of an open source tool developed by Mandiant to perform mass scanning of public-facing Experience Cloud sites. Mandiant, the Google-owned consulting and incident response biz, released this tool in January to help Salesforce admins detect misconfigurations within the Salesforce Aura framework that could expose sensitive data.
The original tool identifies vulnerable objects by probing API endpoints that these sites expose (specifically the /s/sfsites/aura endpoint). However, ShinyHunters' version goes beyond this and exploits overly permissive guest user settings to extract data, according to Salesforce. The attackers told The Register they had crafted tools that can bypass a 2,000-record retrieval limit built into Salesforce's interface and steal customer information at scale.
The fundamental issue lies not in Salesforce's underlying technology but in how organisations have configured their systems. Publicly accessible Salesforce Experience sites use a dedicated "guest user profile" that allows unauthenticated users to view public pages, FAQs, or submit forms without logging in. However, if this profile is misconfigured with excessive permissions, data that is not intended to be made public may be accessible, allowing a threat actor to directly query Salesforce CRM objects without logging in.
The attackers are using guest user profiles that have been configured to allow public access to objects and fields that should not be made publicly available, and then stealing info, such as names and phone numbers, for follow-on social engineering attacks. Voice phishing remains the most effective initial vector, with attackers impersonating IT staff to trick employees into revealing credentials.
Mandiant, acknowledging the tool's misuse, has moved to assist customers. Mandiant, the Google-owned consulting and incident response biz, released this tool in January to help Salesforce admins detect misconfigurations within the Salesforce Aura framework that could expose sensitive data. The firm signalled that they are working closely with Salesforce and our customers to provide the necessary telemetry and detection rules to mitigate potential risk.
For organisations using Salesforce, the remediation pathway is clear but demands immediate action. Salesforce recommends customers immediately audit guest user permissions and enforce a least privilege access model to restrict access to the absolute minimum objects and fields required. Users should also ensure that the default external access is set to "private" (in Setup > Sharing Settings) for all objects. Plus, uncheck "Allow guest users to access public APIs" in site settings and uncheck "API Enabled" in the guest user profile's System Permissions.
The broader pattern raises questions about whether technology companies have done enough to communicate configuration risks to their customers. Salesforce has been a longtime target of the extortion crew, which has stolen data from hundreds of the CRM giant's customers in a series of attacks over the past year. ShinyHunters was also the crew behind the 2024 Snowflake customers' database intrusions.
There is no quick technical fix that absolves organisations of responsibility. The shared responsibility model in cloud computing means that Salesforce cannot secure misconfigured environments on behalf of its customers. Security leaders who have delayed audits or deferred permission reviews now face immediate pressure to act.