The extortion crew ShinyHunters has published what it says are 7.1 million Salesforce records stolen from Baxter International, the $11.2 billion Deerfield, Illinois maker of IV solutions, infusion pumps and injectable medicines, after the company let a 17 August 2026 ransom deadline pass. Baxter has confirmed the underlying intrusion in its own words, stating on 13 August that it identified "unauthorized activity" involving certain third-party applications. What Baxter has not confirmed is the rest of it: the company has not named ShinyHunters, has not named Salesforce, and has not validated the 7.1 million figure. Every source reviewed here reports the same 7.1 million count, but every one of them traces it back to a single origin, the criminals' own leak-site post.
What Happened
The timeline is unusually tight and, for once, the victim moved first. Baxter posted its unauthorized-activity statement on 13 August 2026. ShinyHunters listed Baxter on its dark web leak site on 14 August, according to both Darkfield and Breach House, which independently index leak-site postings and cross-check against ransomware.live, RansomLook and RansomWatch. The listing carried a "FINAL WARNING PAY OR LEAK" banner and a hard deadline of 17 August, threatening publication plus what the gang called "several annoying (digital) problems that'll come your way."
Baxter did not pay. Accounts differ slightly on exactly when the data went live. BreachNews logged an update stating ShinyHunters published the alleged Baxter data on 18 August. The gblock write-up places the download button appearing on Wednesday 19 August, citing GovInfoSecurity, and HealthcareInfoSecurity, reporting on 21 August, also describes the download post as landing on a Wednesday. Darkfield's tracker lists the leak date as unknown. The honest read is that publication occurred between 18 and 19 August; the discrepancy is a day, and it does not change the outcome.
Alongside the post, ShinyHunters wrote: "The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care." Baxter, for its part, said there has been "no impact to manufacturing operations, customer operations, patient services or business continuity," and that it has "no evidence that this activity affected Baxter products, connected solutions or technologies used by customers to deliver patient care."
Baxter was not alone in this wave. BreachNews reports that the same batch of listings named Cook Medical, Carhartt and Sharecare, with archives for all three published while Baxter was still under its pay-or-leak clock. The gang also posted a general notice warning of more leaks to come as it worked through what it described as an influx of victims.
What Was Taken
The claim is 7.1 million Salesforce records containing personally identifiable information. That number is consistent across gblock, HealthcareInfoSecurity, Darkfield, Breach House and BreachNews, but consistency here is not corroboration. It is one claim, republished five times.
Critically, the leak-site listing does not specify which categories of PII are involved, and it does not state a dataset size in gigabytes. BreachNews notes both omissions explicitly. Breach House's victim page shows redacted proof-of-breach thumbnails with filenames including file_tree.png, finance_2024.xlsx, passport_scan.jpg and contract_signed.pdf, which suggests a mix of corporate and identity-document material, though redacted thumbnails on an aggregator site are weak evidence and the underlying files have not been independently reviewed.
One caution on tier: Darkfield's automated dossier labels this "Confirmed exfiltration of PII at significant scale," but that language comes from an AI-generated severity summary on an aggregator, not from Baxter, a regulator, or any forensic finding. Nothing in the primary or established-press sourcing confirms the volume. Treat 7.1 million as an unverified attacker claim. Leak-site counts routinely inflate, and a Salesforce object export can multiply row counts well beyond the number of distinct individuals affected.
For context on how these numbers scale in this sector, gblock notes that Baxter is the second medical products maker ShinyHunters has claimed in 2026, following a 9 million record claim against Medtronic in April. That figure carries the same caveat.
Why It Matters
Baxter makes IV solutions and infusion pumps. Any incident touching that company raises an immediate and reasonable question about clinical safety, and Baxter has answered it directly: no impact to manufacturing, no impact to patient services, no evidence of effect on products or connected solutions. Take that at face value. This is a CRM data theft, not an OT or device-integrity event.
The strategic significance lies elsewhere. Health-ISAC issued a 24 July advisory, reported by BleepingComputer, warning healthcare and medical technology organizations of a measured increase in successful ShinyHunters attacks. Baxter, Cook Medical and Sharecare landing in a single mid-August wave is that warning materialising roughly three weeks later. If your organization received that advisory and filed it, this is what filing it looks like.
The second point is about disclosure sequencing. Baxter's statement preceded the leak-site listing by one day. In a campaign where victims typically stay quiet until the data is already downloadable, getting out ahead by even a day indicates the company knew what was coming and chose to speak first. That is the correct play, and it is worth noting that it did not prevent publication. Early disclosure buys credibility with customers and regulators; it does not buy leverage with the extortionist.
Breach House frames the remaining gap as "Window Zero," the interval between leak-site appearance and formal victim notification, which it still lists as pending. Baxter's 13 August statement acknowledges unauthorized activity but is not an individual breach notification. For a US healthcare-adjacent entity holding PII at this alleged scale, HIPAA and state notification obligations are the next shoe, and the substance of those filings will be the first genuinely authoritative record count.
The Attack Technique
Baxter has not described the intrusion path beyond "third-party applications." That phrasing, however, aligns precisely with the tradecraft documented by the highest-tier source in this set.
Microsoft's security research team, in a 13 July 2026 advisory, documented campaigns observed between mid-2025 and mid-2026 with tradecraft overlapping ShinyHunters, targeting customer Salesforce instances through abuse of trusted OAuth relationships. Microsoft identifies two primary intrusion paths:
Vishing targeting OAuth consent. Attackers call employees and talk them into authorizing a malicious connected app. The app then inherits legitimate user and application privileges.
Supply chain compromise through trusted integrations. Microsoft names Salesloft and Gainsight as examples of trusted workflows abused to reach downstream customer tenants.
Both paths yield the same result: the ability to enumerate and query CRM records at scale while evading conventional authentication detections, because the queries arrive over an authorized token rather than a suspicious login. Microsoft is emphatic on one point, and it should be repeated: "This activity was not the result of a vulnerability inherent to Salesforce." The failure is in consent governance and integration hygiene, not the platform.
BleepingComputer's reporting on the Health-ISAC advisory adds the identity-attack variant. ShinyHunters uses vishing against employees and helpdesk staff to force password resets, MFA method changes or new device enrollments, then logs into the victim's Okta, Microsoft Entra or Google SSO dashboard. That dashboard lists every SaaS app the compromised user can reach, turning one account into a springboard across Salesforce, Microsoft 365, SharePoint, DocuSign, Slack, Atlassian, Dropbox and Google Drive. BleepingComputer has previously reported the group using custom phishing kits purpose-built for voice-based operations. The group has run the same pattern against Snowflake environments using stolen OAuth tokens.
Neither Microsoft nor Health-ISAC names Baxter. The connection between that tradecraft and this incident is inference from Baxter's own "third party applications" language plus the attacker's Salesforce claim. It is a strong inference, and it is still an inference.
What Organizations Should Do
Inventory and prune connected OAuth apps. Enumerate every connected application in Salesforce and every enterprise app in Entra, Okta or Google Workspace. Revoke anything unrecognized, unowned or unused. Microsoft's guidance centres on this, and it is the single highest-yield action.
Restrict who can grant consent. Remove end-user consent for third-party applications and route requests through an admin approval workflow. A malicious connected app authorized by one tricked employee is the entire vishing path in this campaign.
Enable Salesforce event monitoring and API-volume alerting. Microsoft consulted with Salesforce specifically to improve telemetry granularity for Defender for Cloud Apps, adding near-real-time detection with connected-application attribution and expanded permission insight. Mass record enumeration over a valid token looks normal to authentication logging; it looks anomalous to query-volume baselines.
Harden the helpdesk against voice social engineering. Per the Health-ISAC advisory, require out-of-band verification before any password reset, MFA method change or new device enrollment. Callback to a number of record, manager attestation or in-person verification. Scripted verification questions that use publicly discoverable information are worthless here.
Deploy phishing-resistant MFA. FIDO2 security keys or device-bound passkeys defeat the credential-relay step. Where full rollout is not immediate, prioritise SSO administrators, helpdesk staff and anyone with broad CRM export rights.
Vet third-party integration partners as breach paths. Salesloft and Gainsight are named by Microsoft as compromised routes into customer tenants. Map which vendors hold live tokens into your SaaS estate, confirm token scope is minimal, and establish who calls whom when a vendor is compromised.
Assume CRM data is exfiltratable and reduce what sits there. Purge stale contact records, restrict export permissions by role, and apply field-level encryption to identity-document and financial fields. A 7.1 million record claim is only possible where 7.1 million records are reachable from one session.
Sources: ShinyHunters Leaks 7.1M Baxter Salesforce Records | Defending SaaS-based applications against ShinyHunters OAuth abuse... | ShinyHunters Leaks 7.1 Million Baxter International Records | Data breach detection, prevention and notification ... | Health-ISAC warns of rising ShinyHunters data theft attacks on heal... | Baxter International, Inc. data breach — Shinyhunters ransomware le... | Baxter International, Inc. — SHINYHUNTERS Ransomware Attack Breach... | ShinyHunters Claims Baxter, Carhartt and More Breaches