Hallmark Breach Exposes 1.7 M Customer Records via Compromised Salesforce Instance
What Happened — In March 2026 attackers accessed Hallmark’s customer data stored in its Salesforce CRM, extorted the company, and published the data after the deadline passed. The leak includes 1,736,520 unique email addresses, names, phone numbers, physical addresses and support‑ticket contents from both Hallmark and its Hallmark+ streaming service.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient third‑party oversight: a breach in a SaaS provider directly compromised millions of end‑user records.
- Highlights the need for continuous monitoring and evidence collection on vendor security controls to satisfy audit requirements.
- Shows that a defensible incident‑response plan must include supply‑chain breach playbooks and documented due‑diligence.
Who Is Affected – Retail & e‑commerce organizations that rely on external CRM platforms; SaaS CRM providers handling personal data.
Recommended Actions
- Review and tighten contractual security clauses with Salesforce (or any CRM vendor).
- Deploy continuous third‑party risk monitoring to capture security posture changes in real time.
- Update incident‑response procedures to include supply‑chain breach detection, containment, and reporting.
Source: Have I Been Pwned – Hallmark breach
Technical Notes – Attack vector: compromise of a third‑party SaaS dependency (Salesforce). Data types exposed: email addresses, names, phone numbers, physical addresses, support‑ticket content. No specific CVE disclosed. Source: same as above