The Salesforce data breach involved the ShinyHunters (UNC6240) hacking group, which exploited stolen OAuth tokens from Salesloft’s GitHub account to infiltrate Drift’s Salesforce integration and subsequently compromise Gainsight, a customer process management platform. The attackers gained unauthorized access to over 200 Salesforce instances, exfiltrating enterprise customer data through third-party service integrations (including HubSpot and Zendesk). While Salesforce revoked access keys and removed affected apps from the AppExchange, the breach exposed sensitive customer data, though the full scope of the leak remains undisclosed. The attack leveraged supply-chain vulnerabilities rather than a direct Salesforce platform flaw. ShinyHunters claimed delayed detection (1–2 weeks post-intrusion) and sought internal accomplices for further exploitation. Salesforce refused ransom demands, but the incident highlights risks in third-party integrations and credential-based attacks.

The luxury fashion brand Chanel announced a data breach affecting some of its customers in the United States. The breach involved unauthorized access to a US database hosted by a third-party service within Chanel's Salesforce environment. The exposed data included limited details such as names, email addresses, mailing addresses, and phone numbers of individuals who had contacted the US client care center. No malicious software was used, and daily operations were not affected. The breach was linked to a group of cybercriminals known as ShinyHunters, who used social engineering techniques like vishing to trick employees into revealing login details. Chanel promptly activated security procedures and engaged cybersecurity experts to investigate the incident.

The incident at Gainsight stemmed from a downstream effect of the August 2025 Salesloft breach, where the Scattered Lapsus$ Hunters group stole OAuth tokens tied to Salesloft’s Drift AI chat integration with Salesforce. These tokens granted unauthorized API access to 760 Salesforce instances, leading to the exfiltration of 1.5 billion records, including passwords, AWS keys, and Snowflake tokens.A subgroup, ShinyHunters, exploited the stolen credentials to breach Gainsight’s systems, extracting customer contact data (names, business emails, phone numbers, regional details), licensing information, and support case contents. Salesforce responded by revoking all active Gainsight-associated tokens and temporarily removing its apps from the AppExchange to mitigate further exposure. While Salesforce clarified that its platform itself was not vulnerable, the breach originated from Gainsight’s external app connections, compromising sensitive corporate and customer data across hundreds of organizations.

Cybercrime Surges in 2025–2026: The Shift from Hacking to "Logging In" In 2025, the U.S. reported a record $20.9 billion in cybercrime losses up 26% from the previous year marking the first time annual damages exceeded $20 billion. However, the real shift lies not in the scale of theft but in the method: attackers are increasingly bypassing traditional hacking in favor of stolen credentials, AI-driven scams, and trusted third-party vendors. The FBI’s Internet Crime Complaint Center (IC3) logged over 1 million complaints, yet this figure represents only about 25% of actual victims, suggesting the true cost could be several times higher. ### Key Trends and Tactics 1. The "Log In, Don’t Break In" Era - Stolen credentials accounted for 53% of breaches in 2025, with attackers simply signing in as legitimate users. The average breach cost $4.81 million, and detection took 328 days nearly a year of undetected access. - Social engineering evolved with AI, boosting phishing success rates by 54%. By late 2026, AI-generated phishing is projected to drive 42% of all breaches. Voice phishing ("vishing") alone enabled attacks on Charter, CarGurus, and Crunchbase. - Ransomware appeared in 44% of breaches (up from 32% in 2024), with half of attacks now skipping encryption to steal and leak data. The average ransomware breach cost $5.08 million, though fewer victims paid (36% in 2025, down from 41%). 2. Supply Chain and Third-Party Risks - Third-party breaches doubled in 2025, costing $4.91 million per incident. Two U.S. banks Citizens and Frost were compromised on the same day through a shared vendor. - ShinyHunters, an extortion group, exploited corporate sales software (Salesforce, Microsoft 365) to scrape 1.5 billion records from over 1,000 organizations, including Google, Cisco, and Chanel. Their campaign defined 2026, with the education platform Canvas exposing 275 million records the largest breach in its sector. 3. Industry Impact - Healthcare remained the costliest target ($11.2 million per breach), driven by high-value medical records and regulatory penalties. Financial services followed at $6.08 million, while manufacturing led in ransomware claims due to production-line disruptions. - Small businesses were disproportionately hit: 43% of attacks targeted them, with 88% involving ransomware. Only 17% carried cyber insurance, and 60% of breached small firms closed within six months. 4. AI’s Role in Cybercrime - The IC3 tracked over 22,000 AI-related complaints in 2025, totaling $893 million in losses. Attackers used AI for phishing (37% of cases) and deepfake impersonation (35%). By 2026, AI-driven attacks were projected to account for 16% of all breaches. ### Notable Breaches - France’s ANTS: 11.7 million citizens’ ID records exposed, with permanent damage due to irrevocable biometric data. - NYC Health + Hospitals: 1.8 million records, including fingerprints, stolen via a third-party vendor. - Coinbase: 70,000 customers’ data compromised by bribed support agents, costing up to $400 million in remediation. - Carnival: 6 million customers’ passport details leaked after a socially engineered breach. ### Defensive Gaps and Costs - The global cybersecurity workforce shortage reached 4.8 million in 2025, with budget cuts not talent gaps now the primary cause of understaffing. Breaches in understaffed organizations cost $1.76 million more on average. - Proactive measures proved effective: A tested incident-response plan cut breach costs by $2.66 million, while AI and automation reduced detection time to 51 days (vs. 241 days industry-wide). Zero trust architecture saved an additional $1.76 million per breach. - Cyber insurance premiums rose 15–20% in 2026, with ransomware driving 60% of large claims. Only 17% of small businesses carried coverage, leaving them vulnerable to fatal financial losses. ### The Bigger Picture The 2025–2026 data reveals a stark reality: the weakest link is no longer technology but human trust. Attackers are exploiting credentials, AI, and supply chains to bypass defenses, while industries like healthcare and manufacturing face structural risks that even robust security can’t fully mitigate. With global cybercrime costs projected to reach $10.5–$10.8 trillion in 2026, the focus has shifted from preventing breaches to limiting their damage before the data leaves the building.