Desk live·
ForensicPost
Cloud/Analysis/File 25-1006

A CRM Holds the Commercial Position of Every Account in One Place

A CRM is filed as a sales tool. It holds the commercial position of every account, every contact, every deal and every complaint — assembled deliberately in one place.

Constructed geometry · not a chart of case data
TargetCRM tenants
ActorMultiple
S. Rosler11 min readConfidence: medium2 sources reviewed

The 2025 SaaS extortion campaign targeted customer relationship management tenants. This file records what that category of system contains, because the answer determines how the incidents should be read.

It Is Not Primarily A Database Of Names

A mature CRM holds contact records, yes. It also holds every open opportunity with its value and probability, contract terms, discount history, renewal dates, support escalations, churn risk scoring, and the notes salespeople write about which executive at a customer actually decides.

That is a comprehensive description of a company’s commercial position and of its relationships with named individuals at other companies. It exists in one system by design, because the entire value proposition is consolidation.

Most Of It Triggers Nothing

Notification law follows personal data. Contact records qualify; a pipeline valuation, a discount schedule and a note about a customer’s internal politics do not.

So an organisation can lose the whole of its commercial position and notify only on the contact fields — the structure filed at 25-0916 for law firms and 25-1204 for manufacturing. The disclosure describes the least consequential part of what was taken.

And The Notes Are The Part Nobody Accounts For

Free-text fields in a CRM contain what employees wrote when they assumed only colleagues would read it: assessments of individuals, accounts of meetings, speculation about a customer’s finances.

No data inventory captures it, because the field is "notes". The people described are third parties at other organisations who were never customers of anyone here, have no relationship to sever, and will not be notified.

Graded medium: this describes the category and is not a finding about any specific tenant’s contents.

This is an analysis file

It describes what CRM systems generally hold, read against the 2025 campaign files. It is not a claim about the contents of any affected tenant. Corrections: corrections@forensicpost.com.

Sources
  1. ShinyHunters calling: financially motivated data extortion targeting enterprise cloud applicationsEclecticIQ
  2. What Salesforce organizations need to know about ShinyHunters and vishingVaronis
S. Rosler
Covers extortion groups and leak-site economics. Verifies our sample sets.
// the chain of custody — tuesdays

Get the next file first.

One incident a week, taken apart properly. Logs, timelines, and what the filing left out.

PGP-signed edition · no tracking pixels · one-click unsubscribe
© 2026 ForensicPost Media · the desk · newsletter · searchGlossary