A Ransomware Gang Built a Salesforce Leak Portal. It's Working.

The B2B Data Marketplace Nobody Asked For

A ransomware group called ShinyHunters has done something quietly remarkable: they've built what amounts to a shadow B2B data marketplace, complete with branding, customer segmentation, and a very specific value proposition. The product? Alleged Salesforce customer records. The pitch? 1.5 billion records from 760 companies that use Salesloft and Drift alongside Salesforce.

This isn't your standard data dump on a dark web forum. This is a dedicated leak site, structured as a pressure tool specifically for companies whose business runs through Salesforce-driven pipelines. The attackers aren't just stealing data — they're thinking in terms of SaaS stacks and named B2B brands.

Two Competing Realities

Salesforce, through spokesperson Allen Tsai, has taken an unusual line: their findings indicate these attempts relate to past or unsubstantiated incidents. The company stresses there's no indication the core Salesforce platform was compromised or that any known vulnerability in their technology was exploited.

So you have two narratives operating in parallel. One from a criminal group marketing "Salesforce leaks" like a product category. Another from Salesforce insisting this is either historical or unsubstantiated and not tied to any platform vulnerability. The gap between these stories tells you something about how enterprise security works now — vendors and attackers are increasingly talking past each other about what constitutes a "breach."

The Attack Surface Is the Ecosystem

The claim of 1.5 billion records from 760 companies hints at something B2B vendors don't advertise: once you start chaining together SaaS tools — Salesforce plus Salesloft plus Drift — your effective attack surface is no longer the CRM itself, but the ecosystem around it.

Every integration is a seam. Every API connection is a potential entry point. Every third-party tool that touches your Salesforce instance expands the perimeter. ShinyHunters appears to understand this better than most security teams.

What's particularly striking is the branding. A "Salesforce customer data leak site" is deliberate positioning. The attackers know that the way Salesforce structures business relationships — centralizing customer data, sales pipelines, and revenue forecasts in one platform — makes those victims more likely to pay. It's not just data theft; it's extortion calibrated to the B2B sales cycle.

Data Centralization as Leverage

This crystallizes an unintended consequence of SaaS adoption that doesn't get talked about enough: data centralization becomes reputational leverage.

When your entire customer lifecycle runs through a platform like Salesforce, any hint that your CRM data is exposed becomes existential. Your prospects, your deal sizes, your pipeline stage, your win rates — all of it potentially visible to competitors, journalists, or anyone else willing to pay. The consolidation that makes modern B2B operations efficient also makes them vulnerable in new ways.

The old model of enterprise security was perimeter defense: keep the bad guys outside the firewall. The new model is supposed to be zero trust: assume breach, limit lateral movement, verify everything. But what happens when the breach isn't your infrastructure, but your vendor's vendor's API integration?

What This Means Going Forward

Attackers are now thinking in terms of platform dependencies and named B2B brands, not just generic databases. They're structuring their operations around the same SaaS ecosystems that power modern businesses. They're even using similar language — "Salesforce leaks" as a product category, customer segmentation by tech stack, value propositions tailored to enterprise buyers.

For B2B companies, this creates an uncomfortable reality: the platforms you depend on for operational efficiency are also single points of failure for reputation management. And the question of whether Salesforce itself was breached or whether the exposure happened somewhere in the surrounding ecosystem almost doesn't matter — if customer data from your Salesforce instance is for sale, the damage is the same.

The strangest part? A criminal group has effectively built a B2B go-to-market strategy around stolen CRM data. They've identified their target customer (companies heavily invested in Salesforce), packaged their offering (access to competitor intelligence and customer lists), and created urgency (pay or we publish). It's textbook enterprise sales. Just in reverse.