Abrigo Data Breach: ShinyHunters Extortion Exposes 700K Contacts

In April 2026, the fintech software provider Abrigo was subjected to a “pay or leak” extortion attempt by the notorious ShinyHunters group. This incident, as reported by Have I Been Pwned, resulted in the public release of data allegedly exfiltrated from Abrigo’s Salesforce instance. The breach exposed over 700,000 unique email addresses, affecting both Abrigo staff and their external contacts.

The compromised data, consistent with prior incidents, included critical business contact information such as institution names, employee names, email addresses, and phone numbers. While Have I Been Pwned notes this specific incident is separate from a previous Salesforce compromise via the Drift application connector, the consistency in data fields underscores a recurring vulnerability in managing third-party application access to sensitive platforms.

This incident highlights the persistent threat of extortion groups like ShinyHunters and the critical need for robust data segmentation and access controls within cloud environments like Salesforce. The exposure of such extensive business contact information creates a fertile ground for sophisticated phishing campaigns and further supply chain attacks.