ShinyHunters Exposes 5.1M ZenBusiness Customer Records
What Happened — In March 2026 the extortion group ShinyHunters announced they had extracted data from ZenBusiness’ Snowflake, Mixpanel and Salesforce environments. After a ransom demand went unanswered, the group publicly released terabytes of files containing roughly 5 million unique email addresses, many paired with names and phone numbers.
Why It Matters for Trust & Control Assurance —
- Continuous third‑party risk monitoring is designed to detect and document unauthorized access to vendor‑hosted data.
- Maintaining auditable logs of vendor activity provides defensible evidence for audits across frameworks such as NIST CSF and ISO 27001.
- Demonstrable due‑diligence on SaaS integrations helps satisfy control objectives around access control and vendor oversight.
Who Is Affected — Small‑business owners and entrepreneurs using ZenBusiness, and any SaaS platforms that rely on similar third‑party data pipelines.
Recommended Actions —
- Conduct an immediate review of all third‑party integrations (Snowflake, Mixpanel, Salesforce) and enforce least‑privilege access.
- Deploy continuous monitoring tools to capture and retain vendor activity logs for audit readiness.
- Update contracts to require vendors to provide evidence of access‑control enforcement and breach‑notification procedures.
Technical Notes — The breach involved exfiltration of email addresses, names, and phone numbers from CRM‑related systems. No specific vulnerability (CVE) was disclosed; the attack vector appears to be compromised credentials or inadequate segregation of duties. Source: https://haveibeenpwned.com/api/v3/breach/ZenBusiness