Hallmark Data Breach Exposes 1.7 Million Customers via Salesforce Compromise, Including Hallmark+ Records
Published
Key Takeaways
- Data exposure: The March 2026 Hallmark data breach compromised 1.7 million unique email addresses and associated personal identifiers through a Salesforce attack.
- Extortion: Threat actors published exfiltrated datasets after the established ransom demands expired, including support ticket information.
- Multi-platform impact: The compromised dataset encompasses customer records from both Hallmark and the Hallmark+ streaming platform.
A Hallmark data breach in March 2026 exposed 1.7 million customer records after ShinyHunters exfiltrated and published user datasets obtained by compromising the organization's Salesforce cloud infrastructure.
The set of unique email addresses from both Hallmark and the Hallmark+ streaming service was added to the Have I Been Pwned (HIBP) breach intelligence platform on April 12, 2026. The data was leaked after the extortion demands expired.
Salesforce Compromise
ShinyHunters exploited the organization's Salesforce environment to extract comprehensive customer databases from Hallmark Cards, Inc., and Hallmark+ streaming service subscribers. Initially, the ransomware group threatened to release nearly 8 million records of PII and private corporate data.
The HIBP datasets contain critical personally identifiable information (PII), such as:
- Email addresses
- Names
- Phone numbers
- Physical addresses
- Support tickets
Risk Assessment
Given the shared infrastructure between Hallmark+ streaming services and primary retail network operations, affected users face heightened exposure to advanced persistent threat vectors. Standard best practices recommend that users change their passwords.
Early this month, an alleged Cisco breach was linked to the Trivy supply chain compromise, with ShinyHunters claiming to have obtained 3 million Salesforce records. In March, ShinyHunters claimed a data compromise involving Snowflake, Okta, Sony, AMD, LastPass, and Salesforce via a massive Salesforce breach.
ShinyHunters claimed the Salesforce data breach via third-party Gainsight, announcing “almost 1,000” victims. A February Mandiant report outlined the group’s extortion tactics, vishing, and SSO compromise of target cloud environments.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Monday.
Most Popular