Berkadia Salesforce Data Breach Exposes 305K Accounts
What Happened — In March 2026, the extortion group ShinyHunters claimed to have stolen data from Berkadia’s Salesforce environment and published a “pay‑or‑leak” dump containing 305,216 records (email addresses, names, phone numbers, physical addresses, and employer information).
Why It Matters for Trust & Control Assurance
- The incident illustrates a classic third‑party risk failure: a SaaS CRM that was not continuously monitored for security hygiene.
- Continuous vendor‑risk monitoring provides the evidence needed to demonstrate due‑diligence and a defensible audit trail when a supplier is compromised.
- Control‑assurance programs that require documented access reviews, MFA enforcement, and regular security attestations can surface such gaps before data is exfiltrated.
Who Is Affected — Commercial‑real‑estate finance firms and any organization that stores customer‑identifiable information in Salesforce or similar cloud‑based CRM platforms.
Recommended Actions
- Immediately review Salesforce access logs for anomalous activity and enforce MFA for all privileged accounts.
- Conduct a vendor‑risk reassessment of the Salesforce contract, focusing on security controls, incident‑response clauses, and evidence collection.
- Capture and retain evidence of the remediation steps (log reviews, MFA rollout, contractual updates) for audit readiness.
Source: HIBP breach record
Technical Notes
- Data Types Exposed: Email addresses, names, employers, phone numbers, physical addresses.
- Attack Vector: Likely credential compromise or misconfiguration within the third‑party SaaS environment, leveraged by an extortion campaign.
- No public CVE; the breach is attributed to a “pay‑or‑leak” extortion effort.
Source: HIBP breach summary