**********Salesforce supply chain data breach fallout + PipeLeak AI vuln patch (McGraw Hill 45M records; ShinyHunters Cisco claim)** [developing]** [developing]
Key Questions
What was the scope of the Salesforce-linked data breach involving OneDigital?
A breach via Drift/Salesloft in Aug 2025 exposed 28k OneDigital users' SSNs and names. It impacted 700+ orgs including Slack and OpenAI through supply chain vulnerabilities.
What is ShinyHunters' claim regarding Salesforce and Cisco?
ShinyHunters claimed a breach of 3M records via phishing/OAuth on Cisco Salesforce instances. McGraw Hill was added with 45M records leaked, demanding ransom by April 14 2026.
What is PipeLeak and how was it addressed?
PipeLeak is an AI agent vulnerability via prompt injection in lead forms, patched by Microsoft and Salesforce configs with human-in-loop. Maine notices on April 8 2026 highlight ongoing OAuth risks tempering SaaS hype.
ShinyHunters McGraw Hill breach via SFDC misconfig (45M records claimed/limited non-PII/non-sensitive, ransom Apr14 passed); Salesforce-linked via Drift/Salesloft (Aug2025) exposed 28k OneDigital SSNs/names, supply chain hit 700+ orgs incl Slack/OpenAI. Cisco/SFDC claim (3M phishing/OAuth); PipeLeak AI agent vuln (prompt injection lead forms, patched MS/Salesforce config/human-in-loop); Apr8 2026 Maine notices highlight ongoing liability/reputation risks/OAuth vulnerabilities, tempers SaaS rally/buyback/Agentforce hype.