Stellantis, a leading global car manufacturer, has acknowledged that hackers gained unauthorized access to a Salesforce platform used by its North American customer service division.
🔍 What Stellantis Said
- Stolen data: customer contact information only
- No financial or sensitive data involved
- Activated incident response protocols and informed authorities
- Customers advised to beware of phishing attempts
📌 Linked to ShinyHunters Campaign
Cyber-extortion group ShinyHunters has claimed responsibility, stating they stole 18 million Salesforce records from Stellantis.
This breach is part of a wider Salesforce data theft wave, where attackers:
- Used voice phishing (vishing) and stolen Salesloft Drift OAuth tokens
- Compromised Salesforce instances of Google, Cisco, Allianz Life, Qantas, Adidas, Dior, Louis Vuitton, Tiffany & Co., and others
- Claimed theft of 1.5 billion records across 760 companies
📢 FBI Warning
The FBI issued a Flash alert last week, warning organizations about this attack campaign and urging Salesforce customers to review OAuth integrations and monitor access logs.
💡 Why it matters
Even without financial data being exposed, stolen contact details can enable large-scale phishing and social engineering attacks. Given Stellantis’ massive global footprint, attackers could weaponize this data for fraud, extortion, or supply chain compromises.
At Alcaeus Services, we help enterprises defend against supply chain breaches, strengthen identity controls, and monitor for OAuth token abuse in SaaS platforms.
