ShinyHunters extort Baxter over Salesforce breach

ShinyHunters claims theft of 7.1M Salesforce records with PII from Baxter International and is threatening to leak the data unless paid by 17 Aug 2026.

A listing on a ransomware/extortion leak site attributes a data breach of Baxter International, Inc. to the ShinyHunters group. The actors claim to have compromised over 7.1 million Salesforce records containing personally identifiable information, along with credentials for 141 employees, 139 users, and 123 third-party employee accounts. The post is framed as a 'final warning,' giving the victim until 17 August 2026 to pay before the data is leaked, a pattern consistent with ShinyHunters' established extortion-without-encryption model.

The disclosed data points to exposure through Baxter's Salesforce environment and associated SaaS/cloud service integrations (Amazon SES, Microsoft 365, Atlassian, DocuSign, Twilio, OneTrust, and others identified via DNS/TXT record verification strings), suggesting the intrusion may have leveraged compromised third-party or SaaS-connected credentials rather than a direct network breach. No malware or exploited vulnerability is described in the posting; this appears to be a data-theft and extortion event rather than a ransomware deployment.

Baxter International is a major medical device and healthcare products manufacturer, making the scale of PII exposure and threatened leak significant for patient and employee privacy. Given the volume of records (7.1M) and imminent leak deadline, organizations using similar SaaS platforms should review third-party access controls and monitor for exposed credentials tied to Baxter or its vendors.

title: Salesforce Bulk API or Report Export with High Record Volume
description: Detects Salesforce platform event log entries (Report, ListViewEvent,
  BulkApiResultEvent, BulkApiRequestEvent) where the number of rows/records processed
  in a single event is very high, consistent with bulk extraction of CRM data (e.g.
  mass PII harvesting) rather than normal user reporting activity.
tags:
- attack.collection
- attack.t1530
logsource:
  category: application
  product: salesforce
detection:
  selection:
    EventType:
    - Report
    - ListViewEvent
    - BulkApiResultEvent
    - BulkApiRequestEvent
  high_volume:
    RowsProcessed|gte: 5000
  filter_known_integration:
    ClientId|contains:
    - MuleSoft
    - Informatica
    - Tableau
  condition: selection and high_volume and not filter_known_integration
falsepositives:
- Scheduled analytics/BI jobs (Tableau, Einstein Analytics) pulling large report datasets
- Approved data warehouse ETL integrations performing nightly bulk syncs
level: medium
id: 2e83a3cb-d3a5-5bad-a5e9-1f0e63b1be27
status: experimental
author: Vorant

title: Non-Interactive Client Bulk Retrieval from SaaS API Endpoint
description: Detects outbound HTTP(S) requests to CRM/SaaS API domains (e.g. Salesforce)
  using automated or scripting clients (Data Loader, curl, python-requests, PostmanRuntime)
  combined with large response sizes, matching a pattern of bulk data pull that could
  represent exfiltration of records via an authorized cloud API rather than a browser
  session.
tags:
- attack.exfiltration
- attack.t1567
logsource:
  category: proxy
  product: windows
detection:
  selection:
    c-uri|contains:
    - salesforce.com
    - force.com
    cs-user-agent|contains:
    - DataLoader
    - curl
    - python-requests
    - PostmanRuntime
    - Java/
  large_transfer:
    cs-bytes|gte: 5000000
  filter_known_integration:
    cs-user-agent|contains:
    - MuleSoft
    - Informatica
  condition: selection and large_transfer and not filter_known_integration
falsepositives:
- Legitimate ETL or middleware jobs using scripted API clients to sync CRM data on
  a schedule
- Sanctioned data migration or backup tooling using Data Loader against Salesforce
level: medium
id: 1cccee55-e89f-575a-b0a2-23f6cf88c215
status: experimental
author: Vorant

title: Salesforce Connected App OAuth Token Used for High-Volume Object Query
description: Detects Salesforce API/event log entries where a single OAuth connected-app
  session (identified by ClientId/AppName) issues an unusually high count of API/SOQL
  query events, consistent with automated bulk scraping of Salesforce objects (Accounts,
  Contacts, Leads) using a compromised or abused API token, rather than a normal integration
  cadence.
tags:
- attack.collection
- attack.t1530
logsource:
  category: application
  product: salesforce
detection:
  selection:
    EventType:
    - API
    - RestApi
    - ApiTotalUsage
  high_query_count:
    ApiCallCount|gte: 1000
  filter_known_integration:
    ClientId|contains:
    - MuleSoft
    - Informatica
    - Tableau
  condition: selection and high_query_count and not filter_known_integration
falsepositives:
- Approved middleware or integration platforms performing scheduled bulk syncs
- Internal analytics tools with legitimately high API call volume
level: medium
id: 8cde2df5-9322-5460-9b0c-4359e05556e4
status: experimental
author: Vorant

Source reporting: https://www.ransomware.live/id/QmF4dGVyIEludGVybmF0aW9uYWwsIEluYy5Ac2hpbnlodW50ZXJz