Home / Incidents / Data breach
ShinyHunters claims 1.5 billion Salesforce records from 760 firms
Stolen Drift OAuth tokens were used to pull CRM data from hundreds of companies.
- Organisation
- Salesforce customers (Salesloft Drift)
- Disclosed
- 17 September 2025
- Affected
- 1,500,000,000 (claimed by attacker, unconfirmed)
- Data
- CRM contacts, cases, accounts
- Attacker
- ShinyHunters
- Severity
- critical
- Region
- Global
- Source
- CM Alliance monthly roundup ↗
Cite this
Nuffield Consulting, “ShinyHunters claims 1.5 billion Salesforce records from 760 firms”, The Daily Tech Wire outage & breach log, 17 Sep 2025. https://techwire.nuffieldconsulting.com/incidents/2025-09-17-salesforce-customers-salesloft-drift-breach/ (retrieved 15 Nov 2026).
This entry summarises public reporting. Please also cite the original source: CM Alliance monthly roundup, https://www.cm-alliance.com/cybersecurity-blog/sept-2025-biggest-cyber-attacks-ransomware-attacks-and-data-breaches.
Related incidents
- 26 Sep 2025Hackers steal data on 8,000 nursery childrenKido nurseries (London) · breach · Radiant · 8K records
- 30 Sep 2025Harrods third-party breach affects 430,000 customersHarrods · breach · Unknown · 430K records
- 22 Sep 2025Stellantis confirms breach via Salesforce compromiseStellantis · breach · ShinyHunters
- 15 Sep 2025Former FinWise employee accesses 689,000 customer recordsFinWise · breach · Insider · 689K records
- 10 Sep 2025JLR confirms data stolen in production-halting attackJaguar Land Rover · breach · Scattered Spider