Berkadia Data Breach (2026)

On March 19, 2026, commercial real estate finance company Berkadia became the latest victim of the ShinyHunters extortion group, which published a dataset containing information on 305,000 people after the company did not meet the group's demands.

Reported Details of the Incident

Public reporting indicates the attackers claimed to have accessed data from Berkadia’s Salesforce instance. The exposed records include names, email addresses, phone numbers, physical addresses, and employer information. The group followed its typical “pay or leak” pattern, releasing the files on a leak site after the deadline passed.

Have I Been Pwned lists the breach with 305K unique email addresses confirmed in the published archive. No evidence has surfaced that payment card data, Social Security numbers, or financial account credentials were included in the leak.

Why This Matters for You and Your Family

When a company that handles commercial financing stores your contact details in its customer relationship management system, that information can end up in the hands of criminals. The combination of your name, physical address, phone number, and email is often enough for identity thieves to open accounts, request credit lines, or impersonate you to family members and colleagues.

Even if you never directly did business with Berkadia, the data may have come from a vendor, partner, or previous employer that shared your information. Once it is public, anyone can buy or download it and begin building a profile on you or members of your household.

The Doxxing and Identity-Chain Risks

Names paired with current addresses and phone numbers accelerate doxxing campaigns. Attackers can cross-reference the leaked data against social media, gaming platforms, and public records to map family relationships and target children’s accounts. A single exposed email from this breach can unlock password-reset links on other services where the same password was reused.

Credential leaks of this nature frequently cascade into account takeovers on gaming platforms. Children’s usernames, linked through shared family addresses or parent emails, become entry points for harassment, extortion, or further data theft. The chain can expand rapidly from one company’s customer file to a detailed household portrait.

ShinyHunters’ Publicly Known Track Record

Public reporting attributes the Berkadia incident to ShinyHunters, a group that emerged several years ago and has targeted numerous organizations with similar “pay or leak” tactics. Notable prior victims include large retailers, streaming services, and other firms whose customer databases contained contact information rather than payment card data.

The group’s typical playbook involves initial access to cloud-hosted customer management platforms such as Salesforce, exfiltration of contact records, followed by extortion demands with a short deadline. If payment is not received, the data is published on dark-web leak sites. This pattern has repeated across multiple incidents, with the group focusing on volume of records rather than highly sensitive financial details.

What to do

• Rotate any password you used at Berkadia or any connected vendor and enable 2FA through an authenticator app on every account where that password was reused.
• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real-world identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure of your data is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts that can chain back to the same leaked address or parent email.
• Let DoxxScan remediation specialists manage takedown requests across data brokers and exposed profiles on your behalf.

The Berkadia incident shows how quickly contact information maintained by ordinary businesses can surface in extortion campaigns. Taking concrete steps now limits how far attackers can travel down the identity chain that begins with a single leaked record. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts—protection that directly addresses the cascade risks illustrated by this breach.