ShinyHunters' Pay-or-Leak Hits Zara, Carnival, 7-Eleven: The CRM Playbook

ShinyHunters did not hack Zara, Carnival, or 7-Eleven in the way the word “hack” usually implies. On April 18, 2026, the group posted nine victims to its extortion site with a single deadline — April 21 — and the familiar choice that gives the campaign its name: pay, or the data goes public. The early framing was that one shared third-party provider tied the three brands together. It didn’t. What actually links a Spanish fashion house, a cruise operator, and a convenience chain is not a vendor. It is a repeatable business model: log into the SaaS platform a company already trusts, export the customer database, and extort the brand with the result.

The specifics differ by victim, and the distinction matters because extortion crews inflate. Against Zara, ShinyHunters tied its access to Anodot, an analytics vendor, and a downstream Snowflake/BigQuery instance — not Zara’s own network. Parent company Inditex acknowledged “unauthorized access” to its databases but denied that names, phone numbers, addresses, passwords, or bank-card data were exposed. Against 7-Eleven, the group claimed more than 600,000 records lifted from a Salesforce environment. Against Carnival, it claimed 8.7 million records and “terabytes” of internal data — a figure Carnival has not confirmed and that remains an unverified attacker claim.

Three Brands, Three Doors, One Playbook

Read the vectors side by side and the pattern is unmistakable. Each intrusion bypassed the brand’s own perimeter by abusing a system it had already authorized — a breached analytics vendor for Zara, a CRM tenant for 7-Eleven. There was no zero-day, no ransomware payload, no encrypted file server. The attacker arrived holding a valid credential or a live API session, and to the platform that traffic looked like ordinary, sanctioned access. This is data-theft extortion, not encryption ransomware, and it defeats the defense most organizations still lead with: backups don’t help when the threat is publication, not deletion.

The 7-Eleven case is the one that moved from claim to confirmation. In late May, the company acknowledged a breach — an “unauthorized third party” had reached systems used to store franchisee documents, with the incident dated to April 8. 7-Eleven did not name ShinyHunters or confirm the Salesforce angle, but the breach-notification service Have I Been Pwned analyzed the leaked archive and put the count at roughly 185,300 people, with names, dates of birth, email addresses, phone numbers, and physical addresses exposed. ShinyHunters says it dumped a 9.4GB archive after the ransom was refused. The lesson in the gap between “600,000” claimed and “185,300” verified: take the attacker’s numbers as a ceiling, not a fact.

The Salesforce Campaign Behind the Headline

This trio is not a standalone event — it is one visible edge of the sprawling Salesforce data-theft campaign that ShinyHunters and its affiliates ran through 2025 and into 2026. The signature technique is social engineering: voice-phishing an employee into authorizing a malicious connected app, or approving an OAuth grant, that hands the attacker legitimate access to the CRM. From there, a bulk-export tool pulls the tenant clean. The same crew later folded these names into a broader leak trove tying more than 40 organizations — Mytheresa, Pitney Bowes, and others among them — to stolen data the group vowed to keep online “indefinitely.” It mirrors the pattern in our earlier report on ShinyHunters’ third-party breach of Rockstar Games: the brand’s front door was never touched; a trusted dependency was.

My Read

The story here is the industrialization of CRM and SaaS extortion. ShinyHunters has turned a bespoke intrusion into an assembly line, and the Salesforce campaign is the defining security pattern of 2025–26 for a reason: it proves that the most valuable data in a modern company no longer sits behind the firewall you spent a decade hardening. It sits in a SaaS tenant, reachable by a token, an API session, or a vendor you onboarded and forgot. When identity is the perimeter, a phished login or an over-scoped connected app is the whole attack — malware optional.

That reframes the defender’s job. The uncomfortable truth in the Zara denial is that it is probably accurate and beside the point: Inditex’s own systems may well have been untouched, yet the brand still ate the headline because a third party held its customer data. In an identity-first, extortion-only world, you are accountable for every database anyone can reach with your name on it — including the ones you don’t operate. Data minimization stops being a compliance checkbox and becomes the control: what a connected app can never export cannot be leaked.

What Defenders Should Do

For any team running Salesforce or a comparable CRM, this campaign is a direct-to-you threat model. Concrete moves:

• Deploy phishing-resistant MFA. Retire SMS and app-push codes for anyone who can reach the CRM and move to FIDO2/passkeys — the voice-phishing that seeds this campaign dies against hardware-bound authentication.
• Govern connected apps and OAuth grants. Inventory every authorized app and integration, revoke the dormant ones, and require admin approval for new connected-app installs so an employee can’t authorize an attacker’s tool in a phone call.
• Monitor for bulk exports. Alert on abnormal API volume, mass record queries, and Data Loader / bulk-export activity — the smash-and-grab download is the one loud moment in an otherwise quiet intrusion.
• Scope third-party and vendor access. Give analytics tools and integrations least-privilege, read-limited access, and treat every vendor that touches customer data as part of your own attack surface.
• Minimize what the CRM holds. Purge stale records, tokenize or omit sensitive fields, and shorten retention — in an extortion-only model, data you don’t store is data that can’t be held against you.

Open Questions

Several threads stay unresolved. Carnival has not publicly confirmed the 8.7-million-record claim, so that figure remains the attacker’s word alone. Zara’s exact exposure — and whether Inditex’s “no sensitive data” assurance holds up against the leaked sample — is not fully established. Nor is it clear how many of the 40-plus listed organizations quietly paid; the disappearance of some victims from the leak site hints at settlements that will never be announced. Treat the record counts here as claims under investigation, not audited totals.

Primary Documents

• Cybernews — ShinyHunters adds Zara, Carnival, 7-Eleven to leak list
• BleepingComputer — 7-Eleven data breach exposes 185,000 people
• TechRadar — ShinyHunters exposes 40+ organizations in new data trove
• Cybernews — ShinyHunters dumps data tied to Mytheresa, Zara, Carnival, 7-Eleven