Threatline

Abrigo - 711,099 breached accounts

In April 2026, the fintech software company . Shortly after, data allegedly taken from the company's Salesforce instance was published publicly and contained over 700k unique email addresses belonging to both Abrigo staff and external contacts. Whilst separate from , the data fields described in that incident are consistent with the ShinyHunters data, namely that it was "business contact information" including "institution name, employee name, email addresses, and phone numbers". Abrigo was targeted in a "pay or leak" extortion attempt by the ShinyHunters group Abrigo's Salesforce compromise via the Drift application connector the previous year