# ShinyHunters extort data center firm over Salesforce breach

Published: 2026-08-23 · Severity: high · Sectors: infrastructure, technology
Canonical: https://vorant.io/reports/ce49f10c-6167-5d9b-9a13-c831ed4a67eb/shinyhunters-extort-data-center-firm-over-salesforce-breach

> ShinyHunters is threatening to leak 12.9 million Salesforce records and sensitive physical/security data from an unnamed data center operator unless a $13M ransom is paid.

A ransomware.live listing attributed to the ShinyHunters extortion group details a data-theft incident against a data center services company (the listing redacts the victim's name but the source URL identifies it as CyrusOne, LLC). The actors claim to hold 12.9 million Salesforce records exfiltrated via the victim's CRM, including over 182,000 customer contact rows and more than 8,300 rows of employee PII (names, emails, job titles, phone numbers). They also claim possession of a 369.6GB compressed SharePoint archive (288,729 files) containing executed contracts, NDAs, leases, and highly sensitive physical security material — data center floor plans, electrical diagrams, security system schematics, badge/key inventory logs, and the victim's Critical Environment Reliability Management (CERM) process library.

Of particular concern to defenders is the reported theft of credential and access-control artifacts, including a PasswordList.xlsx file, Okta SSC access lists, and data center access control forms — material that could enable follow-on physical or logical intrusion if leaked or sold. The actors issued a final 24-hour ultimatum (as of 23 Aug) demanding $13 million before public release. This follows the broader pattern of 2025-era Salesforce-focused data extortion campaigns attributed to ShinyHunters, which have targeted large enterprises' CRM instances for bulk data theft rather than encryption-based ransomware. No indicators of compromise, malware, or exploited vulnerabilities were disclosed in this listing.

## Mentioned in this report

- Threat actors: ShinyHunters

## Detection guidance (public sample)

### Salesforce Bulk API or Report Mass Data Export

ATT&CK: T1567

Detects large-volume Salesforce Bulk API results, report exports, or list-view exports consistent with CRM record mass exfiltration as seen in Salesforce-focused extortion campaigns. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Salesforce Bulk API or Report Mass Data Export
description: Detects Salesforce EventLogFile events indicating bulk data extraction
  via the Bulk API, report export, or list-view export mechanisms. ShinyHunters-style
  Salesforce extortion operations rely on these native export paths to pull millions
  of CRM records rather than exploiting a vulnerability. Volume threshold should be
  tuned/aggregated downstream (e.g. alert when repeated selection hits exceed org
  baseline within an hour) since Sigma cannot express counting thresholds natively.
tags:
- attack.exfiltration
- attack.t1567
logsource:
  category: application
  service: salesforce
detection:
  selection:
    EVENT_TYPE:
    - BulkApiResultEvent
    - ReportExport
    - ListViewEventStream
  filter_small:
    ROWS_PROCESSED|lte: 1000
  condition: selection and not filter_small
falsepositives:
- Scheduled ETL/BI jobs performing nightly bulk report exports for data warehousing
- Legitimate large list-view exports by sales operations staff
level: medium
id: 0fd37294-5324-5595-a65f-7fee33aad014
status: experimental
author: Vorant
```

### SharePoint or OneDrive Mass Content Export Operation

ATT&CK: T1530

Detects SharePoint/OneDrive audit operations associated with bulk content export or full-site download, matching the pattern of large compressed archive theft from cloud file storage. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SharePoint or OneDrive Mass Content Export Operation
description: Detects Microsoft 365 unified audit log operations indicating bulk export
  or full download of SharePoint/OneDrive content (e.g. site export, eDiscovery-style
  export, or full sync download). Large-scale SharePoint archive theft (hundreds of
  GB, hundreds of thousands of files) as reported in Salesforce/SharePoint extortion
  incidents relies on these native export/download operations rather than malware.
  Correlate with unusually high object/file counts per user/session at the SIEM layer
  since Sigma cannot express volumetric thresholds natively.
tags:
- attack.collection
- attack.t1530
logsource:
  product: m365
  service: audit
detection:
  selection:
    Workload: SharePoint
    Operation:
    - ExportContent
    - SearchExportOperation
    - FileSyncDownloadFull
  condition: selection
falsepositives:
- Legal/eDiscovery teams performing legitimate case-related content exports
- IT migration or backup jobs performing full-site sync downloads
level: medium
id: a8907c2b-d45f-5446-84f9-fc5960de8c00
status: experimental
author: Vorant
```

### Download or Access of Credential and Access-Control Named Files in Cloud Storage

ATT&CK: T1530

Detects access or download of files whose names indicate stored credentials or physical/logical access-control material (e.g. password lists, SSO access lists, badge/key logs) from cloud file storage, matching the sensitive-file targeting reported in the CyrusOne SharePoint theft. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Download or Access of Credential and Access-Control Named Files in Cloud Storage
description: Detects file access/download events in cloud storage (SharePoint/OneDrive)
  audit logs where the object name suggests stored credentials or access-control material
  - password lists, SSO access lists, badge/key inventories. Generalises on the naming
  convention rather than the specific campaign filename (PasswordList.xlsx), since
  theft of such artefacts enables follow-on physical or logical intrusion.
tags:
- attack.collection
- attack.t1530
logsource:
  product: m365
  service: audit
detection:
  selection:
    Operation:
    - FileDownloaded
    - FileAccessed
  sensitive_name:
    ObjectId|contains:
    - password
    - credential
    - secret
    - access control
    - accesscontrol
    - badge
  condition: selection and sensitive_name
falsepositives:
- IT/security staff auditing or updating password policy documentation
- Facilities staff reviewing badge/access control templates as part of normal duties
level: high
id: b8af792c-0eae-5807-aa4f-b1c5f1f2f321
status: experimental
author: Vorant
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/Q3lydXNPbmUsIExMQy5Ac2hpbnlodW50ZXJz

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ce49f10c-6167-5d9b-9a13-c831ed4a67eb/shinyhunters-extort-data-center-firm-over-salesforce-breach.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup