2026 Baker Distributing — ShinyHunters SharePoint/Salesforce leak; 103k emails (HIBP)
Data compromised
Names, emails, phones, physical addresses, job titles, employer names, HVAC contractor support tickets, SharePoint HR/admin documents per HIBP and Cybernews sample review
Technical writeup
In May 2026 ShinyHunters listed U.S. HVAC/R wholesale distributor Baker Distributing Company (bakerdist.com) on its pay-or-leak site, claiming more than 260,000 Salesforce records. After the May 27 negotiation deadline, the group published data allegedly from SharePoint and Salesforce. Have I Been Pwned loaded the incident in early June 2026 with 102,935 unique email addresses plus names, physical addresses, phone numbers, and support tickets tied to HVAC contractor customers; HIBP characterized the exposure as largely corporate contact and support information. Cybernews sample review described SharePoint HR/admin materials and roughly 1,100 structured employee records with bakerdist.com emails. Baker Distributing had not published a matching English-language forensic notice in indexed trade press at HIBP catalog time; BreachHistory uses the HIBP-verified email count.
Root cause
ShinyHunters extortion campaign; published archive after failed negotiations