140,000 Records Leaked in Ralph Lauren ShinyHunters Salesforce Breach
Published
Key Takeaways
- Extortion Campaign: ShinyHunters targeted fashion retailer Ralph Lauren in a June 2026 "pay or leak" extortion attack.
- Data Published: The group leaked hundreds of gigabytes of data allegedly taken from Ralph Lauren's Salesforce instance.
- Records Exposed: The leak exposed almost 140,000 unique email addresses, along with names, phone numbers, and more.
Roughly 140,000 Ralph Lauren breached accounts were added to the breach notification service Have I Been Pwned (HIBP) on June 18, 2026. The fashion retailer was targeted by the ShinyHunters hacking group in a June 2026 extortion campaign. The threat actors deployed a "pay or leak" strategy, demanding payment before publishing stolen data they claimed to have obtained from the company.
What Data Was Exposed in the Ralph Lauren Breach
The leaked dataset contained 139,903 unique email addresses and associated identifiers. According to HIBP, the compromised data categories were:
- Email addresses
- Names
- Phone numbers
- Genders
- Age groups
The Ralph Lauren data breach claim was observed on June 11, with ShinyHunters alleging ownership of customer personally identifiable information (PII), purchase and transaction records, and documents containing plans for unreleased products and collections.
ShinyHunters Claimed Ralph Lauren
ShinyHunters subsequently published hundreds of gigabytes of data, which the group claimed was sourced from Ralph Lauren's Salesforce instance under a "pay or leak" model.
By centering the attack on a Salesforce environment, the campaign aligns with the broader pattern of ShinyHunters' activity targeting cloud-based CRM platforms, including the data breaches at Infinite Campus and Kemper Corporation.
The incident adds Ralph Lauren to the growing list of organizations named in ShinyHunters extortion activity, with other recent incidents including the recent Amazon One Medical compromise, the confirmed Kodak intrusion, and the Council of Europe data breach.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular