Overview

• Have I Been Pwned reports that names, genders, dates of birth, emails, phone numbers, and addresses were taken from a Salesforce-hosted database.
• BleepingComputer says ShinyHunters leaked roughly 2.8 million database records spanning customers and business partners such as wealth firms and advisors.
• Allianz disclosed that attackers accessed a third-party CRM on July 16 and that customer and employee information was stolen.
• A spokesperson told Reuters the company will provide two years of identity monitoring to people it identifies as impacted.
• Reporting links the incident to a broader Salesforce-targeted campaign that used malicious OAuth apps and social engineering to exfiltrate data.