ThreatPaper

#salesforce

3 cases

McKesson Data Breach: ShinyHunters, One Phone Call, and 284 Million Rows of Patient Data

ShinyHunters says it vished McKesson employees, took over Okta sessions, and pulled a terabyte from Salesforce and Snowflake between 20 and 25 August 2026. McKesson has confirmed exfiltration of patient data and nothing about how.

Data BreachExtortion & BlackmailSocial Engineering
ShinyHunters Salesforce Data Extortion and SaaS Supply-Chain Campaign (2025–2026)

Between mid-2025 and August 2026, a cybercriminal collective operating primarily under the ShinyHunters brand—alongside associated activity clusters tracked as UNC6040, UNC6240, UNC6395, UNC6661, and...

Data BreachSupply Chain Attack
Klue Supply Chain Compromise and Downstream Salesforce Data Exfiltration

Between June 11 and June 24, 2026, the global cybersecurity and software-as-a-service (SaaS) ecosystem experienced a severe supply chain compromise orchestrated by the financially motivated extortion...

Data Breach