ShinyHunters Campaign Hit Public-Facing Salesforce Experience Cloud Portals

In early March 2026 a large-scale data theft and extortion campaign began against organisations running public-facing Salesforce Experience Cloud portals. The group claimed data from hundreds of organisations and threatened publication from 14 March unless demands were met.

Experience Cloud exists to expose selected records to people outside the organisation — customers checking an order, partners submitting a claim, applicants tracking a case. Public access is the feature. The failure is in what "selected" turned out to mean.

A portal serves unauthenticated visitors through a guest user profile, and that profile accumulates permissions the way any long-lived configuration does. An object is shared to make one page work. A sharing rule is widened during a launch. Nobody revisits it, because the page works.

The result is a permission set nobody designed and nobody owns, sitting in front of a database that also holds records never intended for external eyes. No perimeter is crossed to reach them. The application is asked politely, and it answers.

The economics favour the attacker unusually strongly. The same misconfiguration pattern recurs across thousands of tenants; testing for it is cheap and can be automated; and each success yields a complete customer database rather than a foothold requiring further work.

Financial regulators have issued their own alerts to member firms on this pattern, which is a reasonable signal of how broadly it applies. When a sector regulator writes to its members about a specific SaaS configuration, the assumption should be that it is widespread rather than exotic.

The remediation is unglamorous: audit the guest user profile, enumerate every object it can read, and confirm each one is intended. Most organisations have never done it once.