Pitney Bowes
Third breach in seven years. ShinyHunters compromised their Salesforce environment and walked out with 8.2 million customer records.
What happened?
In April 2026, the ShinyHunters hacking collective compromised Pitney Bowes through unauthorized access to its Salesforce environment. After ransom negotiations failed, ShinyHunters publicly released the stolen data. Have I Been Pwned confirmed the breach on April 27, adding 8,243,989 unique email addresses to its database.
What data was actually inside?
8.2 million unique email addresses, full names, phone numbers, and physical mailing addresses. A subset of records also contained Pitney Bowes employee information including job titles. The data came from their Salesforce CRM—the system that holds customer relationships, support histories, and business contact information.
For a company whose core business is mailing and shipping logistics, the exposed addresses aren't just contact details. They're the foundation of customer shipping operations, business correspondence, and commercial relationships spanning decades.
Who gets hurt and how?
Pitney Bowes serves businesses of all sizes—from small offices using postage meters to enterprises managing global shipping operations. Every one of those 8.2 million email addresses now sits in attacker databases. Phone numbers and physical addresses enable spear phishing, social engineering, and business email compromise.
Exposed employee data compounds the problem. Job titles tell attackers who handles finances, who approves payments, who has system access. This is reconnaissance data for the next attack—not against Pitney Bowes, but against their customers.
What did they think they were doing right?
Pitney Bowes stated they "immediately secured the environment, revoked the compromised access, and engaged leading cybersecurity experts and law enforcement." They also found "no evidence that the activity extended into other Pitney Bowes systems."
This is the third breach in seven years. In 2019, Maze ransomware hit them. In 2020, another attack disrupted operations. Each time, they contained it. Each time, they recovered. Each time, they believed the perimeter was finally secure. The Salesforce environment was supposed to be different—cloud-hosted, enterprise-grade, professionally managed.
What did they not know about their own data?
Salesforce environments accumulate data. Every customer interaction, every support ticket, every sales conversation gets logged. Over years of operation, that CRM instance becomes a repository of business relationships the organization may not fully inventory.
Pitney Bowes claimed "no indication that sensitive personal data was accessed." But 8.2 million records with names, emails, phone numbers, and physical addresses is sensitive personal data. The gap between what the organization classified as sensitive and what attackers actually took reveals the inventory problem.
If you use Salesforce, you probably have the same data types—emails, names, addresses, phone numbers. Do you know which fields contain PII?
What does attribution look like the morning after?
ShinyHunters gave Pitney Bowes until April 21 to negotiate. When the deadline passed, the data went public. Now Pitney Bowes faces notification obligations across every state where those 8.2 million customers reside. That's potentially 50 different notification requirements, 50 different attorney general offices, 50 different timelines.
For customers, the exposure is already complete. The data is on breach forums, indexed by Have I Been Pwned, available to anyone who wants it. Notification letters will arrive weeks after attackers have already harvested the information for credential stuffing and phishing campaigns.
What would have changed the outcome?
Knowing what sensitive data actually lived in that Salesforce environment before attackers found it.
When Pitney Bowes said "no indication that sensitive personal data was accessed," they revealed the classification gap. An organization that had inventoried its Salesforce data—mapped every field, understood what customer information existed where, classified it properly—would have known immediately what was at risk. Instead, they learned the contents of their own systems from a Have I Been Pwned notification.
Third breach in seven years. Same fundamental problem each time: not knowing exactly what data exists in which systems until someone else tells you.
Pitney Bowes found out the hard way.
Your team could spend the next 6 months rebuilding systems, notifying customers, and answering legal questions. Or you could spend 24 hours finding out what's actually at risk.