Baker Distributing Data Breach Exposes 103K Customer Records from SharePoint and Salesforce
What Happened – In May‑June 2026 the ShinyHunters extortion group posted data it claimed to have stolen from Baker Distributing’s SharePoint and Salesforce environments. The leak includes 102,935 unique email addresses, names, phone numbers, physical addresses and support‑ticket details.
Why It Matters for Trust & Control Assurance
- Continuous monitoring of SaaS access logs is essential to detect unauthorized data extraction before it becomes public.
- Documented vendor‑oversight and access‑control evidence provide a defensible audit trail for compliance programs.
- Demonstrable SaaS control hygiene signals a mature trust posture to partners and regulators.
Who Is Affected – B2B wholesale distributors in the HVAC/R sector and their corporate customers.
Recommended Actions
- Review and tighten SharePoint and Salesforce permission sets; enforce MFA and remove dormant accounts.
- Deploy continuous SaaS control‑monitoring to capture access events and generate audit‑ready evidence.
- Conduct a third‑party risk assessment of all cloud services and update your vendor‑oversight policies.
Technical Notes – The breach originated from compromised SharePoint and Salesforce instances; the exact entry vector was not disclosed. Exfiltrated data consists of corporate contact information and support tickets, which are low‑to‑moderate sensitivity but valuable for phishing and social engineering. Source: https://haveibeenpwned.com/api/v3/breach/BakerDistributing