Ameriprise Financial Data Breach Exposes 502K Accounts via Salesforce & SharePoint Leak
What Happened — In March 2026 the ShinyHunters group announced a “pay‑or‑leak” extortion campaign against Ameriprise Financial. The attackers claimed to have stolen more than 200 GB of data from the firm’s Salesforce CRM and internal SharePoint sites, later publishing the data when negotiations failed. The leak included over 500 k unique email addresses, names, phone numbers, physical addresses, employer information and limited financial transaction details.
Why It Matters for Trust & Control Assurance
- This incident illustrates the risk of insufficient oversight of third‑party SaaS platforms; a continuous control‑assurance program would require documented vendor risk assessments and ongoing monitoring of access.
- Demonstrable evidence of heightened monitoring and identity‑verification procedures is essential to show due diligence to regulators and auditors.
Who Is Affected – Financial services firms that rely on cloud‑based CRM/Collaboration tools (e.g., Salesforce, SharePoint).
Recommended Actions –
- Review and update third‑party risk management policies, ensuring contracts include security and breach‑notification clauses.
- Conduct a focused audit of SaaS access logs, privilege assignments, and data‑exfiltration controls; collect evidence for audit readiness.
- Implement continuous monitoring alerts for anomalous data downloads from cloud applications.
Technical Notes – The breach stemmed from unauthorized extraction of data stored in Salesforce and SharePoint; no specific CVE was disclosed. Exfiltrated data types: email addresses, names, phone numbers, physical addresses, employer details, and limited financial transaction information. Source: Have I Been Pwned – Ameriprise breach