Convenience store giant 7-Eleven confirmed a data breach in April 2026, where the ShinyHunters gang accessed their Salesforce environment. The attackers exfiltrated over 600,000 records of corporate and personally identifiable information, subsequently leaking a 9.4GB archive after ransom demands were not met.
Initial Access
Salesforce Credential Compromise
likely
The ShinyHunters gang gained unauthorized access to 7-Eleven's Salesforce environment, which stored franchisee documents. This likely involved the use of compromised credentials.
Defender cut points
Enforce phishing-resistant FIDO2 MFA on all Salesforce accountsImplement strong password policies and regular credential rotationMonitor for unusual login activity to cloud services
