ShinyHunters extortion campaign extends to Salesforce records at Pitney Bowes, 7-Eleven, Canada Life, Alert 360

Analysis
The Aura-based guest-user misconfiguration turns every Experience Cloud tenant deployed before January 2026 into a standing target, and remediation coverage is very likely incomplete across SMB deployments, meaning the campaign's addressable pool has not materially shrunk since September 2025. The 21 April Pitney Bowes deadline is the almost-certain near-term signal on whether the extortion model holds: payment by deadline propagates capitulation across remaining victims and extends the campaign into Q3 with new monthly targets; successful resistance forces the largest single PII dump of the year but may fracture the coercive logic if enterprises read the outcome as proof non-payment is survivable. Corroborated across DB Digest, SharkStriker, and Ransomware.live leak-site tracking.