TL;DR: SharkStriker reports that ShinyHunters exposed over 500,000 Salesforce records at Cushman & Wakefield in early May 2026, including PII and internal corporate data. The breach is the latest in a 2026 pattern of SaaS supply-chain attacks where adversaries compromise OAuth grants, connected apps, or stolen CRM credentials to exfiltrate full customer databases. NC small businesses that run Salesforce, HubSpot, ServiceTitan, Procore, or any cloud CRM face the same playbook. The defenses are SaaS Security Posture Management (SSPM), OAuth grant audits, and managed detection and response.
Worried about your SaaS exposure? Preferred Data Corporation has secured SaaS environments for North Carolina businesses since 1987. Call (336) 886-3282 or request a SaaS security audit.
What happened to Cushman & Wakefield in May 2026?
ShinyHunters, a long-running data-theft and extortion group, exfiltrated more than 500,000 Salesforce records from Cushman & Wakefield, the Chicago-based commercial real estate firm. According to SharkStriker, the stolen records contained personally identifiable information (PII) and internal corporate data. The incident sits within a broader 2026 SaaS attack pattern where ShinyHunters and copycats have targeted Salesforce, Snowflake, GitHub, and other multi-tenant cloud platforms used by enterprises and SMBs alike.
The pattern in these attacks:
| Attack Phase | Technique | What SMBs Need to Watch |
|---|---|---|
| Initial Access | Stolen credentials from infostealer logs, vishing, or OAuth phishing | Identity provider sign-in logs |
| Privilege Escalation | API token theft or OAuth grant abuse | SaaS audit logs |
| Discovery | Reconnaissance of CRM objects, accounts, contacts | API usage anomalies |
| Exfiltration | Bulk export via API or connected app | Outbound API traffic spikes |
| Extortion | Dark-web leak threat plus ransom demand | Threat intelligence feeds |
Key takeaway: ShinyHunters did not exploit a Salesforce zero-day. They exploited the human and operational layer around SaaS: weak MFA, dormant OAuth grants, over-permissioned API tokens, and missing detection on CRM data exfiltration.
Why does the Cushman & Wakefield breach matter for NC small businesses?
Because the same playbook works against any SMB running a CRM with PII or financial data. Salesforce hosts a massive share of NC small business customer data: real estate, professional services, manufacturers, and contractors all use Salesforce, HubSpot, or Microsoft Dynamics 365 to manage pipelines, contracts, and client records. Verizon's 2025 DBIR found 30% of breaches involved a third party - double the prior year.
Three reasons NC small businesses are in the blast radius:
- CRMs hold the crown jewels. A typical NC manufacturer's Salesforce or HubSpot instance contains customer lists, pricing, contracts, contact data, and pipeline forecasts. A bulk export is the most valuable single asset an attacker can take.
- OAuth grants accumulate silently. Manufacturers in High Point, contractors in Charlotte, and professional services firms in Raleigh-Durham connect dozens of integrations to their CRM over time. Each connected app is a credential that can be stolen.
- Detection lags by months. SaaS audit logs are rarely centralized; bulk exports happen in normal business hours and look like a sales rep pulling a list, not an attacker.
Get managed cybersecurity services →
How much does a SaaS supply chain breach cost an NC small business?
The average SMB breach costs $254,445 according to SharkStriker, and PII-driven breaches push that number higher due to state breach notification costs. North Carolina's Identity Theft Protection Act requires notification within 30 days for breaches affecting NC residents, with additional credit monitoring obligations for breaches involving SSN or financial account data.
| Cost Component | Typical Range |
|---|---|
| Forensic investigation (SaaS audit log analysis) | $25,000 - $150,000 |
| Customer notification (NC AG breach law) | $2 - $8 per affected individual |
| Credit monitoring (1-2 years) | $10 - $30 per individual |
| Cyber insurance deductible | $10,000 - $50,000 |
| Regulatory penalties (NC AG, FTC) | $0 - $500,000 |
| Litigation and class action defense | $50,000 - $5M |
| Reputation recovery + PR | $25,000 - $200,000 |
| Lost contracts (RFP disqualification) | $50,000 - $1M |
For a 50-employee NC business with 25,000 contacts in Salesforce, a breach of that database can stack to $350,000 to $7M total exposure. Locking down SaaS access costs a fraction of that.
Key takeaway: SaaS breaches are PII breaches, and PII breaches trigger state breach laws that are expensive to comply with. North Carolina's breach notification regime is one of the more aggressive in the Southeast.
What should NC small businesses do in the next 30 days?
Audit OAuth grants, harden MFA on CRM, and enable SaaS audit logging. The CISA Cloud Security Technical Reference Architecture and Salesforce's own security baseline align on the same priority order: identity first, integrations second, monitoring third.
A defensible 30-day SaaS hardening plan for NC SMBs:
- Day 0-3: Inventory every SaaS app with access to customer data (CRM, marketing automation, ticketing, accounting, e-signature)
- Day 3-7: Audit OAuth grants and connected apps in Salesforce, HubSpot, M365, and Google Workspace; revoke anything dormant or over-permissioned
- Day 7-10: Enforce phishing-resistant MFA on all CRM admin accounts and reduce admin role count to the minimum
- Day 10-14: Disable API access for non-admin users; require named service accounts with rotating credentials for integrations
- Day 14-21: Enable SaaS audit logging and ship to a SIEM or log aggregator; set alerts on bulk exports, unusual API volumes, and admin-role changes
- Day 21-28: Run a tabletop exercise: "ShinyHunters dumped our CRM. What's our response?"
- Day 28-30: Document the incident response runbook for SaaS data exfiltration and brief the executive team
If your business does not have an internal IT or security team, this list is exactly what a managed cybersecurity provider executes in the first 30 days of an engagement.
What does SaaS Security Posture Management (SSPM) actually do?
SSPM tools continuously audit your SaaS configuration against best practices and flag drift, over-permissioned roles, weak MFA, and risky OAuth grants. According to Gartner's SaaS Security Posture Management research, SSPM addresses the gap that traditional security tools cannot: visibility into multi-tenant SaaS where you do not control the underlying platform.
| Capability | What SSPM Does | What It Doesn't Replace |
|---|---|---|
| Configuration audit | Continuously checks settings against benchmarks | EDR on endpoints |
| OAuth grant inventory | Lists all connected apps with risk scoring | Identity provider (Entra ID, Okta) |
| Permission audit | Flags users with admin or broad data access | Least-privilege role design |
| Anomaly detection | Alerts on bulk exports, unusual API volumes | 24/7 SOC monitoring |
| Compliance mapping | SOC 2, ISO 27001, NIST 800-171 controls | Audit firm sign-off |
For SMBs with 5-15 SaaS apps holding customer data, SSPM is the difference between "we hope our SaaS is configured correctly" and "we know our SaaS is configured correctly."
Read our cybersecurity services →
How does an OAuth grant become a data exfiltration channel?
A user grants a third-party app permission to read their CRM. Years later, the app is no longer used, the developer's domain expires, the credentials get stolen, and an attacker uses the still-valid OAuth token to export your customer database. According to The Hacker News, this pattern has driven multiple high-profile SaaS breaches in 2025-2026, including the broader Salesforce attack wave.
What an OAuth grant audit looks like in practice:
| Connected App Risk Tier | Indicator | Action |
|---|---|---|
| High | Dormant 90+ days, unknown publisher, broad data scope | Revoke immediately |
| Medium | Active use, broad scope, single owner | Reduce scope or replace |
| Low | Active use, narrow scope, vendor-managed | Document and monitor |
Salesforce, M365, and Google Workspace all expose admin views for connected apps and OAuth grants. The audit is free; the savings from preventing a breach are enormous.
What if our NC business uses Salesforce specifically?
Salesforce ships strong security features that most SMBs do not turn on. According to Salesforce's security guide, the controls that materially reduce supply chain risk are:
- Multi-factor authentication for all users. Salesforce makes MFA mandatory for most editions but verify enforcement
- IP login ranges. Restrict admin login to office IPs or VPN exit nodes
- Connected app policies. Require admin approval for new OAuth grants
- Field-level security. Limit which user roles can export PII fields
- API access whitelisting. Restrict API access to named integration users
- Event monitoring. Salesforce Shield logs every export and high-risk action
- Health Check tool. Free baseline score and remediation guidance
For NC small businesses on Salesforce Professional or Enterprise, the Health Check tool alone catches 60-80% of the misconfigurations attackers exploit. The remaining 20-40% requires either Salesforce Shield (paid) or an SSPM tool layered on top.
What if our NC business is on HubSpot, Microsoft Dynamics, or another CRM?
The same playbook applies. HubSpot's security guide, Microsoft Dynamics security baselines, and Zoho or Pipedrive equivalents all expose similar controls: MFA enforcement, OAuth grant audit, API token rotation, admin role minimization, and event logging.
The critical step is centralizing logs and detection across whichever CRM you run. A SIEM or managed detection service that watches your CRM audit logs alongside M365 and endpoint logs is the only way to catch bulk exfiltration in time to respond.
Read our managed Microsoft 365 services →
How does PDC help NC small businesses with SaaS supply chain risk?
Preferred Data Corporation delivers managed cybersecurity, managed IT services, and cloud solutions for NC businesses with SaaS security posture audits, OAuth grant reviews, and 24/7 monitoring of SaaS audit logs built into our standard engagement. When a high-profile SaaS breach makes the news, our managed clients receive a same-day advisory with their SaaS inventory, recent OAuth grants flagged, and a remediation plan for the systems most at risk.
For NC small businesses without dedicated security staff, the gap between "ShinyHunters breached another company" and "we audited our SaaS and confirmed we are not exposed the same way" is where breaches happen. Closing that gap is what we do.
Schedule a SaaS security audit:
- Call (336) 886-3282
- Visit preferreddata.com/contact
- Email [email protected]
How should NC businesses harden SaaS for the long term?
Treat every SaaS app as an extension of your network perimeter. Per CISA's Cloud Security guidance and NIST SP 800-204D on cloud-native security, SMBs should adopt:
- Single sign-on (SSO) everywhere. Eliminate per-app passwords; centralize identity
- Phishing-resistant MFA. Passkeys or FIDO2 keys on all admin accounts
- Conditional access by risk. Block impossible-travel, anonymous IPs, and legacy auth
- OAuth grant audits quarterly. Remove dormant apps, narrow scopes, document approvals
- API tokens with expiration. No permanent service-account tokens
- Centralized SaaS audit logs. Ship to SIEM or log aggregator with retention >= 365 days
- DLP on sensitive data. Salesforce Shield, M365 Purview, or third-party DLP
- Vendor risk assessment. Document SOC 2, ISO 27001, or equivalent attestation for every SaaS vendor
Read our third-party data breach defense guide →
Frequently Asked Questions
Was the Cushman & Wakefield breach a Salesforce zero-day?
No. SharkStriker's analysis and the broader pattern of ShinyHunters' Salesforce campaigns indicate the group exploits stolen credentials, OAuth abuse, or social-engineering of CRM admins, not a Salesforce platform vulnerability. The defense is identity and operational hardening, not waiting for a patch.
Are we required to notify NC residents if our SaaS provider gets breached?
Yes, in most cases. North Carolina's Identity Theft Protection Act requires notification of NC residents within 30 days for breaches affecting their PII, regardless of whether the breach happened on your systems or your SaaS provider's. Your contract with the SaaS vendor often shifts cost but not legal obligation.
How long are SaaS audit logs retained by default?
It depends on the platform and license tier. Salesforce default audit logs retain for 180 days (longer with Shield); M365 audit logs retain for 90-180 days on E3 or 365-day retention on E5; Google Workspace logs retain for 6 months on Business Plus. Cyber insurance carriers increasingly require 12-month retention; verify your tenant settings now.
Can we just disable API access to be safe?
No. Most CRMs are integrated with marketing automation, accounting, e-signature, and reporting tools via API. Disabling API access typically breaks core business workflows. The correct approach is to restrict API access to named service accounts with the minimum necessary permissions, rotate credentials quarterly, and monitor API usage.
Should we move off Salesforce because of this breach?
No. Salesforce remains a strong platform with extensive security features. The breaches in 2025-2026 reflect customer configuration gaps, not platform weakness. Migrating to another CRM does not solve the underlying issue; hardening identity, integrations, and monitoring does.