Salesforce issues new security alert tied to third customer attack spree in six months

Salesforce reported active scans and data theft from publicly accessible Experience Cloud sites that have overly permissive guest user settings; a group linked to ShinyHunters claims responsibility and attackers used a modified AuraInspector to enumerate and query exposed CRM objects. Salesforce emphasizes this is caused by customer misconfigurations (not a platform vulnerability) and urges customers to restrict guest user permissions and apply least-privilege controls.