Abrigo Fintech Platform Exposes 711K Staff and Contact Records in ShinyHunters ‘Pay‑or‑Leak’ Breach
What Happened — In April 2026 the ShinyHunters extortion group accessed Abrigo’s Salesforce environment, extracted over 711 000 records (names, emails, phone numbers, job titles, physical addresses) and published them publicly as part of a “pay‑or‑leak” demand.
Why It Matters for Trust & Control Assurance
- Highlights the need for continuous monitoring of third‑party SaaS configurations and access logs to satisfy vendor‑risk control objectives.
- Demonstrates how a lapse in SaaS oversight can erode the defensible evidence required for audit readiness and regulatory due‑diligence.
- Reinforces the importance of documented remediation and ongoing assurance that third‑party risk controls remain effective.
Who Is Affected — Financial‑services firms and fintech SaaS providers that rely on cloud‑based CRM platforms (e.g., Salesforce) for employee and client data.
Recommended Actions
- Immediately review and tighten Salesforce admin access: enforce MFA, enforce least‑privilege, and rotate credentials.
- Deploy continuous third‑party risk monitoring and capture evidence of SaaS security posture in a Trust Center.
- Conduct a data‑exposure impact assessment, notify affected individuals per applicable regulations, and remediate any identified gaps.
Source: Have I Been Pwned – Abrigo breach
Technical Notes
- Attack vector: stolen credentials / compromised admin access to a third‑party SaaS (Salesforce).
- Data types exposed: email addresses, employer names, job titles, personal names, phone numbers, physical addresses.
Source: Same as above