Questel SAS: ShinyHunters Salesforce Data Extortion

"The data-extortion group ShinyHunters has named Questel SAS, a French intellectual-property services firm, on its Tor-based leak site, claiming more than 21 million Salesforce records containing personally identifiable…"

The data-extortion group ShinyHunters has named Questel SAS, a French intellectual-property services firm, on its Tor-based leak site, claiming more than 21 million Salesforce records containing personally identifiable information plus roughly 147 GB of internal corporate data. What is firmly established is the listing itself, reported independently by breachnews.com, HookPhish, UNDERCODE NEWS (citing ThreatMon) and sentinel.ht. What is not established is the breach: Questel had issued no public statement at the time of writing, and none of the reporting outlets have independently verified the group's claims. Treat the volumes below as attacker assertions until Questel or a regulator says otherwise.

What Happened

ShinyHunters added Questel to its leak site alongside two other organisations, Alcon Inc. and Lumenis Ltd., in a single batch. The exact date differs slightly across trackers: breachnews.com says the claims surfaced on 1 August 2026, HookPhish records a breach date of 1 August with discovery on 2 August, while UNDERCODE NEWS and sentinel.ht date the listing to 2 August. All sources agree on the deadline, which the group set at 4 August 2026 for the company to make contact before publication.

The listing text quoted by HookPhish is characteristic of the group's tone: "This is a final warning to reach out by 4 August 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline." That phrasing signals a pure pay-or-leak extortion posture rather than file-encrypting ransomware, despite several trackers filing the incident under a "ransomware group" label.

A separate and later development complicates the picture. On 6 August, UNDERCODE NEWS reported that a threat actor on an underground forum was advertising a Questel customer database attributed to ShinyHunters, containing approximately 1,131,033 unique email addresses. Whether that advertisement represents a partial release of the claimed 21 million records, a resale by a third party, or an unrelated dataset trading on the group's name is not established by any source. The two figures should not be reconciled. Accounts differ, and the gap between 21 million claimed records and 1.13 million advertised email addresses is large enough that it matters.

What Was Taken

Taking the claims at face value and attributing them:

Salesforce records: more than 21 million, containing "some PII," per the leak site listing as reported by breachnews.com, HookPhish and sentinel.ht. All three cite the same figure consistently.
Internal corporate data: approximately 147 GB, per the same listings.
Underground forum sample: roughly 1,131,033 unique email addresses, per UNDERCODE NEWS citing Dark Web Intelligence. Sample records shown in that post allegedly include CRM case management entries, customer support tickets, customer contact information and lead management records, in tables labelled questel_cases and questel_leads.

For scale within the same batch, breachnews.com reports ShinyHunters claimed more than 25 million Salesforce records from Alcon and more than 1.1 million records plus over 176 GB of internal data from Lumenis.

The questel_cases and questel_leads table names, if authentic, are consistent with standard Salesforce Service Cloud and Sales Cloud objects rather than a bespoke internal system. That is a meaningful detail: it points at CRM extraction rather than a deeper compromise of Questel's IP-management platforms. No source alleges that patent or trademark prosecution data itself was taken. sentinel.ht raises the sensitivity of Questel's IP portfolio as a concern, but that is an inference about what a firm like Questel holds, not a claim about the contents of this dataset.

Why It Matters

Questel manages patent, trademark and IP-lifecycle data for corporate clients. Even a CRM-only dataset from such a firm carries second-order risk: the client list, deal pipeline and support-ticket history of an IP services provider maps out which companies are filing what, and when. That is competitive intelligence, and it is exactly the sort of context that makes downstream spearphishing against Questel's clients credible.

The broader pattern is what defenders should be reading here. Health-ISAC issued a 24 July advisory, reported by BleepingComputer, warning of an observed rise in successful ShinyHunters attacks against healthcare and medical technology organisations. Microsoft published research on 13 July documenting the same tradecraft across campaigns observed from mid-2025 through mid-2026, in tenants spanning retail, education and manufacturing. Questel, Alcon and Lumenis sit in IP services, ophthalmic pharmaceuticals and medical lasers respectively. The common factor is not the sector. It is the platform.

SecurityWeek's reporting on Brinks Home shows how these listings resolve when a company refuses to negotiate. ShinyHunters claimed more than 4.9 million records from that firm's Salesforce instance, Brinks Home did not pay, and the group published more than 41 GB of files. Brinks Home's own notice confirmed that attackers accessed a portion of its IT systems while stressing that alarm monitoring and product functionality were unaffected. That is the realistic template for what happens next at Questel if the claims hold and negotiations do not.

The Attack Technique

No source specifies the initial access vector at Questel. What follows is the group's documented tradecraft, drawn from the two strongest sources available: Microsoft's July research and Health-ISAC's advisory as reported by BleepingComputer.

Microsoft identified two primary intrusion paths in campaigns with overlapping ShinyHunters tradecraft. The first is voice phishing aimed at OAuth consent, where staff are called and talked into approving a malicious connected app. The second is supply chain compromise through trusted workflows and integrations, with Microsoft naming Salesloft and Gainsight specifically. Both paths lead to inherited user and application privileges, which allow enumeration and querying of CRM records at scale while evading conventional authentication detections. Microsoft is explicit on one point that matters for how organisations respond: this activity was not the result of a vulnerability inherent to Salesforce. The abuse targets trusted OAuth relationships, not a product flaw.

Health-ISAC's chain, per BleepingComputer, begins earlier in the process. Vishing is used to manipulate employees or helpdesk personnel into resetting passwords, changing multifactor authentication methods, or enrolling new devices. Once an account is taken over, the attackers log into the victim's Okta, Microsoft Entra or Google SSO dashboard, which functions as a directory of every SaaS application that user can reach: Salesforce, Microsoft 365, SharePoint, DocuSign, Slack, Atlassian, Dropbox, Google Drive. For a data-theft crew, that dashboard is a springboard. BleepingComputer has separately reported the group's use of custom phishing kits built for voice-based operations.

sentinel.ht summarises the same four access patterns (vishing, stolen SSO sessions, OAuth token abuse, supply-chain footholds), which aligns with the primary sourcing.

What Organizations Should Do

Inventory and prune connected apps in Salesforce. Enumerate every OAuth-connected application, identify who consented and when, and revoke anything unrecognised, unused or over-scoped. Microsoft's core finding is that the trust relationship, not a Salesforce vulnerability, is the attack surface.
Restrict OAuth consent to administrators. End-user consent is what vishing converts into persistent access. Route all new app authorisations through an admin approval workflow with a documented review step.
Enable Salesforce event monitoring and alert on bulk queries. Microsoft worked with Salesforce to improve telemetry granularity for Defender for Cloud Apps, adding near-real-time detection with connected-application attribution and expanded permission insights. Baseline normal API query volume per connected app and alert on deviations.
Harden the helpdesk against identity resets. Health-ISAC's chain starts with a phone call. Require out-of-band verification (manager callback, video confirmation, in-person check) before any password reset, MFA method change or new device enrolment. Log and review these events daily.
Audit third-party integration partners. Salesloft and Gainsight were named by Microsoft as compromised supply-chain paths. Map which vendors hold live tokens into your CRM, confirm each still needs its current scope, and set an expiry and rotation cadence for integration credentials.
Move to phishing-resistant MFA on the SSO tier. FIDO2 or certificate-based authentication on Okta, Entra or Google breaks the credential-relay step that turns one compromised employee into access to the whole application catalogue.
Rehearse the leak-site scenario, not just the encryption one. There is no decryption key to negotiate for here. Pre-draft holding statements, pre-scope legal and regulatory notification duties (GDPR obligations apply directly to a French data controller like Questel), and decide the payment posture before the countdown clock starts.

Sources: ShinyHunters Extorts Questel Over Salesforce Data | Defending SaaS-based applications against ShinyHunters OAuth abuse... | Brinks Home Discloses Data Breach as Hackers Leak Files - SecurityWeek | Health-ISAC warns of rising ShinyHunters data theft attacks on heal... | ShinyHunters Claims Breaches at Questel, Alcon, and Lumenis | ShinyHunters Claims Two New Victims: Lumenis and Questel Added to R... | Ransomware Group shinyhunters Hits: Questel SAS | Questel Customer Data Allegedly Exposed on the Dark Web, More Than...