Aman Luxury Hotel Data Breach Exposes 215,563 Guest Records from Salesforce CRM
What Happened – In April 2026 ShinyHunters disclosed a “pay‑or‑leak” extortion campaign against Aman, the ultra‑luxury hotel brand. Attackers exfiltrated 215,563 guest records from the company’s Salesforce CRM and posted the data publicly. The leak includes names, email addresses, dates of birth, phone numbers, physical addresses, nationalities, gender, spouse names and VIP status codes.
Why It Matters for Trust & Control Assurance
- The incident illustrates a failure to maintain continuous oversight of a critical third‑party service, a core control‑objective for vendor risk management.
- Without auditable evidence of vendor security posture (access reviews, MFA enforcement, activity logging), organizations cannot demonstrate a defensible control‑assurance posture to auditors or regulators.
- Continuous monitoring and documented due‑diligence provide the evidence needed to show that third‑party risks are being actively managed.
Who Is Affected – Luxury hospitality operators, their guests, and any organization that stores guest data in a cloud‑based CRM.
Recommended Actions
- Review and tighten Salesforce access permissions, enforce MFA for all privileged accounts.
- Update third‑party risk assessments to include recent security‑control evidence from the CRM provider.
- Collect and retain detailed logs of CRM activity as part of your audit evidence.
- Integrate continuous vendor‑risk monitoring into your control‑assurance program to detect future anomalies early.
Source: Have I Been Pwned – Aman breach
Technical Notes – The breach stemmed from a compromise of Aman’s Salesforce CRM environment, likely via credential theft or insufficient vendor‑access controls. The data was leaked as part of an extortion demand (“pay‑or‑leak”). No ransomware or destructive malware was reported.
Source: ShinyHunters public disclosure