Fashion Giant Chanel Hit in Wave of Salesforce Data Theft Attacks

French fashion giant Chanel is the latest company to suffer a data breach in an ongoing wave of Salesforce data theft attacks. Chanel says the breach was first detected on July 25 after threat actors gained access to a Chanel database hosted at a third-party service provider, as first reported by WWD. The breach only impacted customers in the United States and exposed personal contact information.

The attack has been attributed to the ongoing wave of Salesforce data-theft attacks conducted by the ShinyHunters extortion group. Threat actors have been actively targeting Salesforce customers in vishing (voice phishing) attacks to compromise credentials or to trick employees into authorizing a malicious OAuth app with their organization's Salesforce portal. Once they gain access to the Salesforce instance, they exfiltrate the database and use it as leverage in extortion demands on customers.

Total Retail's Take: Data security is a top priority for retailers and brands, yet the challenge is staying ahead of increasingly savvy fraudsters. What does this breach mean for Chanel and its customers going forward? Total Retail received the following insights from Chris Hauk, consumer privacy champion at Pixel Privacy: "The Chanel breach is just the latest incident in a sweeping cybercrime wave orchestrated by the ShinyHunters group, which has been targeting Salesforce users in several countries since early 2025. The bad actors gain access to an organization's Salesforce instance the old-fashioned way — by tricking users into providing their login credentials to a malicious app, using the login to breach their data.

"While no customer financial information was reportedly revealed in the breach, there was enough data revealed to allow the bad guys to phish for additional information by posing as Chanel employees via texts, emails and calls. Customers need to stay alert for such attempts."