2026 Berkadia Commercial Mortgage — ShinyHunters extortion; alleged Salesforce-scale PII exposure (Mar)
Data compromised
Names, contact data, government IDs, financial/tax artifacts, and employment-related fields as alleged in litigation summaries and OSINT listings—scope varies
Technical writeup
In March 2026, criminal-extortion channels and cybersecurity trackers listed Berkadia Commercial Mortgage LLC alongside other high-profile organizations in the ShinyHunters / Salesforce-related extortion wave, with public marketing of very large record counts (on the order of millions of alleged Salesforce rows spanning PII and internal mortgage operations context). Mortgage-industry and plaintiff-side reporting in April 2026 summarized a proposed federal class action citing delayed or inadequate consumer notice and questioning security-program maturity. Treat exact uniqueness, overlap with other SaaS leaks, and headline victim numbers as partially claim-driven pending uniform company forensic totals.
Root cause
Criminal extortion following alleged bulk exfiltration from cloud CRM workflows (Salesforce ecosystem) per threat-actor and trade-press narratives