Loading story…
7-Eleven confirmed that an unauthorized third party accessed systems used to store franchisee documents on April 8, leading to a breach involving personal information submitted during the franchise application process. The company began notifying affected individuals in May and said the total number impacted is still unknown, while ShinyHunters claimed it stole more than 600,000 records from a Salesforce environment containing corporate data and personally identifiable information.
After alleging that 7-Eleven refused to pay, ShinyHunters published a 9.4GB archive of documents on its leak site, escalating a broader campaign that has targeted Salesforce customers since mid-2025. The same extortion group was also linked to a separate breach at Colombian fintech Addi, where a leaked dataset reportedly exposed 34 million unique email addresses along with credit, identity, and socioeconomic data, underscoring the group’s continued focus on monetizing large stores of sensitive customer and business records.
See attribution, scope, and your downstream exposure.
8 events from the most recent confirmed update back to the earliest known activity.
By 2026-05-26, reporting on 7-Eleven's breach said the incident exposed the personal information of about 185,300 individuals. The compromised data reportedly included names, dates of birth, email addresses, phone numbers, and physical addresses.
By 2026-05-18, 7-Eleven publicly confirmed a data breach involving unauthorized access to systems storing franchisee documents. Reporting tied the incident to ShinyHunters' claims of stealing over 600,000 Salesforce records containing personal and corporate information.
By 2026-05-18, reporting on the Addi incident said ShinyHunters had claimed responsibility and released a large dataset allegedly stolen from the company. The exposed data reportedly included 34 million unique email addresses and extensive financial and identity-related records.
On 2026-05-01, 7-Eleven sent breach notifications and filed disclosures in multiple U.S. states confirming that personal information was accessed in the April 8 incident. The company did not disclose the total number of affected individuals.
After 7-Eleven allegedly refused to pay, ShinyHunters published a 9.4GB archive of stolen 7-Eleven documents on its dark web leak site. The leak followed the group's earlier extortion demand tied to the claimed Salesforce data theft.
On 2026-04-17, ShinyHunters claimed it had stolen more than 600,000 records from 7-Eleven's Salesforce environment containing personal and internal corporate data. The group said it would publish the data if a ransom was not paid by 2026-04-21.
On 2026-04-08, an unauthorized third party accessed certain 7-Eleven systems used to store franchisee documents. The compromised files included information submitted during the franchise application process.
In March 2026, Colombian fintech company Addi detected unauthorized activity on its platform and notified customers that their personal information may have been compromised.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
11 references tracked. Mallory keeps watching after this page renders.
techrepublic.com
Open sourcethecyberthrone.in
Open sourceteiss.co.uk
Open sourcebleepingcomputer.com
Open sourcetherecord.media
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourcehaveibeenpwned.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
ShinyHunters, a financially motivated data-theft and extortion group active since 2020, has continued targeting organizations across entertainment, healthcare, education, and criminal infrastructure. Rockstar Games confirmed that attackers accessed a limited amount of non-material company information through a third-party cloud provider, while maintaining that players and operations were unaffected. In a separate September campaign, data allegedly stolen from Swiss medical-device maker Medela was publicly released after a “pay or leak” extortion attempt; the dataset reportedly included roughly 424,000 unique email addresses, corporate contact details, and some support tickets. The group has also claimed attacks against other cybercriminals: it allegedly exploited `CVE-2026-42608`, an unauthenticated path-traversal flaw in Grav CMS, to compromise and deface Clop’s former Tor leak-site server and demand payment. Grav released version 1.7.53.4 after the issue, which had previously been fixed only in the 2.0 branch. Reporting also links ShinyHunters to the theft of more than one billion Salesforce-customer records in 2025 and disruption of the Canvas learning platform in 2026, underscoring how repeated data exposures can be combined into identity profiles that enable account takeover, fraud, and targeted scams.
Sep 30, 2026
Brinks Home disclosed that attackers gained unauthorized access to part of its IT environment and are threatening to leak allegedly stolen data, while extortion group **ShinyHunters** has claimed responsibility for the intrusion. The company said it detected the incident on July 20 and immediately began incident response, adding that its alarm monitoring operations, products, and core system functionality were not affected based on current findings. ShinyHunters alleges it accessed Brinks Home on July 13 through a Microsoft Entra voice-phishing attack and exfiltrated more than **4.9 million** Salesforce records, including some employee personally identifiable information, customer support chat logs, and other data from the company’s Salesforce environment. Brinks Home said it is still determining exactly what information was involved and which individuals may be affected, and warned customers that threat actors may use the incident to send fraudulent messages impersonating Brinks Home or its response partners.
Aug 10, 2026
ShinyHunters has published a broad trove of allegedly stolen data affecting more than 40 organizations across retail, healthcare, hospitality, insurance, and consumer services, with reporting tying the leak campaign to victims including **Bumble**, **Match Group**, **Mytheresa**, **Zara**, **Carnival**, and **7-Eleven**. Researchers said the exposed material includes personally identifiable information, customer and transaction records, internal corporate files, and multi-terabyte datasets; one of the largest alleged exposures involved **Medtronic**, where roughly **9 million records** were reportedly listed before that entry was later removed from the leak site. The campaign reflects ShinyHunters' continued shift from ransomware-style encryption to **data theft and extortion**, with the group allegedly threatening to keep victim data available indefinitely on criminal platforms. Separate reports said the actors claimed to have stolen about **10 million records** from dating-app companies, while researchers also linked leaked **Bumble** data to the same operation after an earlier claim that roughly **30GB** had been taken from the company. The disclosures echo a wider criminal pattern in which stolen sensitive data is leaked to pressure victims after exfiltration, including in healthcare breaches such as the Change Healthcare incident.
Jun 29, 2026