On April 12, 2026, the threat actor group ShinyHunters publicly released 6.2 million customer records belonging to Hallmark after the company refused to pay a ransom demand. The data, totaling 9.59 GB when decompressed, was exfiltrated from Hallmark's Salesforce CRM instance on March 9, 2026, and includes records tied to both hallmark.com and hallmarkplus.com. The dump follows a textbook double extortion playbook: steal, demand, and punish refusal with public exposure.
What Happened
ShinyHunters gained access to Hallmark's Salesforce environment on or before March 9, 2026, extracting the company's entire customer relationship management database. The group then attempted to extort Hallmark, demanding payment in exchange for not releasing the data. When Hallmark declined to pay, ShinyHunters made good on their threat and published the full dataset on monitored hacker forums on April 12, 2026. The breach was publicly reported on April 14.
This follows ShinyHunters' well-documented pattern of targeting large consumer-facing brands, exfiltrating data from cloud platforms, and leveraging public dumps as both punishment and advertisement for future victims.
What Was Taken
The 9.59 GB archive represents what analysts are calling a "Total Consumer Blueprint" of Hallmark's customer base. The exposed dataset includes:
- 6.2 million customer records containing full names, physical mailing addresses, phone numbers, and verified email addresses
- 1.73 million unique email addresses, a high-value asset for credential stuffing and phishing operations
- Internal customer support tickets, revealing account-level context, purchase histories, complaint details, and interaction metadata
- CRM operational data from Hallmark's Salesforce instance, exposing internal workflows and data structures
The inclusion of support ticket content is particularly dangerous. These records provide attackers with conversational context that makes social engineering attacks far more convincing than a simple name-and-email list would allow.
Why It Matters
This breach carries significance well beyond a single retail brand's customer list.
For the retail sector, Hallmark's exposure demonstrates that even non-technical consumer brands with massive customer bases are high-value targets. Greeting card companies do not typically appear on threat models, but they collect the same sensitive PII as any major retailer.
For SaaS security, the Salesforce origin point is a warning shot. The breach did not exploit a vulnerability in Salesforce itself. It exploited how Hallmark configured, integrated, and secured access to its Salesforce tenant. Misconfigured API permissions, overprivileged service accounts, and weak session management within client-controlled SaaS environments remain the most reliable entry points for threat actors targeting cloud infrastructure.
For consumers, the combination of physical addresses, email addresses, and detailed support histories creates a ready-made kit for targeted scams. Expect phishing campaigns impersonating Hallmark customer service, fake breach notification emails, and physical mail fraud leveraging the exposed address data.
The Attack Technique
ShinyHunters compromised Hallmark's Salesforce CRM instance, though the precise initial access vector has not been publicly confirmed. Based on the group's known tradecraft and the nature of the breach, the most likely entry points include:
- Compromised administrator credentials obtained via infostealer malware, credential stuffing, or purchase from dark web markets
- Hijacked API tokens or session cookies from a connected integration, granting persistent access without triggering standard login alerts
- Misconfigured API integrations between Hallmark's internal systems and their Salesforce tenant, exposing bulk data export capabilities to unauthorized actors
The five-week gap between exfiltration (March 9) and public release (April 12) aligns with ShinyHunters' typical extortion timeline: a negotiation window followed by a punitive dump. This group has executed similar operations against Ticketmaster, AT&T, and other high-profile targets using comparable cloud-focused intrusion techniques.
What Organizations Should Do
-
Audit Salesforce and CRM access controls immediately. Review all administrator accounts, connected apps, API integrations, and OAuth tokens. Revoke any unused or overprivileged access. Enable Salesforce Shield Event Monitoring if not already active.
-
Enforce MFA on all SaaS administrator accounts. Credential theft remains the most common entry point for cloud-based breaches. Hardware security keys are strongly preferred over SMS or app-based OTP for privileged accounts.
-
Implement data loss prevention on bulk exports. Configure alerts for any bulk data export operations from CRM platforms. No routine business process should require exporting millions of records without triggering a review.
-
Monitor for credential exposure. Organizations should check whether employee credentials appear in recent infostealer logs and dark web dumps. Proactive credential rotation for any exposed accounts is essential.
-
Prepare for downstream social engineering. Security teams at organizations whose employees may overlap with Hallmark's customer base should warn staff about highly targeted phishing attempts referencing Hallmark account details or support interactions.
-
Review your extortion response playbook. Hallmark's refusal to pay is defensible, but organizations must have a communications and incident response plan ready for the moment a threat actor follows through on a dump. The gap between exfiltration and publication is your preparation window.