The 2025 SaaS extortion campaign targeted customer relationship management tenants. This file records what that category of system contains, because the answer determines how the incidents should be read.
It Is Not Primarily A Database Of Names
A mature CRM holds contact records, yes. It also holds every open opportunity with its value and probability, contract terms, discount history, renewal dates, support escalations, churn risk scoring, and the notes salespeople write about which executive at a customer actually decides.
That is a comprehensive description of a company’s commercial position and of its relationships with named individuals at other companies. It exists in one system by design, because the entire value proposition is consolidation.
Most Of It Triggers Nothing
Notification law follows personal data. Contact records qualify; a pipeline valuation, a discount schedule and a note about a customer’s internal politics do not.
So an organisation can lose the whole of its commercial position and notify only on the contact fields — the structure filed at 25-0916 for law firms and 25-1204 for manufacturing. The disclosure describes the least consequential part of what was taken.
And The Notes Are The Part Nobody Accounts For
Free-text fields in a CRM contain what employees wrote when they assumed only colleagues would read it: assessments of individuals, accounts of meetings, speculation about a customer’s finances.
No data inventory captures it, because the field is "notes". The people described are third parties at other organisations who were never customers of anyone here, have no relationship to sever, and will not be notified.
Graded medium: this describes the category and is not a finding about any specific tenant’s contents.
It describes what CRM systems generally hold, read against the 2025 campaign files. It is not a claim about the contents of any affected tenant. Corrections: corrections@forensicpost.com.