ShinyHunters Claims 7.1 Million Salesforce Records Stolen From Baxter International

Extortion group ShinyHunters listed Baxter International, the medical device maker, on its leak site on August 14, 2026, claiming to have stolen over 7.1 million records containing personal information from Baxter's Salesforce environment. The group issued a deadline to negotiate before threatening to publish the data; Baxter has not confirmed a breach, and no full data sample has been published.

Why This Fits a Larger, Verified Pattern

Baxter is one of many healthcare-sector organizations ShinyHunters has targeted through 2026, part of a documented pattern of attacks specifically against Salesforce-hosted CRM environments across the industry. Health-ISAC has separately warned of increasing ShinyHunters activity targeting healthcare data specifically — this claim, even unverified, fits a confirmed broader campaign rather than standing alone.

• The unverified status matters: no full sample published, vague field descriptions, and no confirmation from Baxter mean this should be treated as a credible claim under investigation, not a confirmed fact
• Regardless of this specific claim's outcome, the pattern (extortion groups specifically targeting Salesforce/CRM environments in healthcare) is independently well-documented and worth acting on directly