Cushman & Wakefield confirms vishing breach claimed by ShinyHunters and Qilin

Cushman & Wakefield, a global commercial real estate services firm, has confirmed a vishing incident that resulted in the theft of more than 500,000 Salesforce records containing personally identifiable information and internal company data. The breach was publicly claimed by both the ShinyHunters and Qilin threat groups, prompting the company to activate its incident response protocols.

Public reporting indicates that the attackers used voice phishing, or vishing, techniques to gain initial access. ShinyHunters specifically claimed responsibility for exfiltrating over 500,000 Salesforce records that included PII along with other internal information. Cushman & Wakefield has acknowledged the cyber incident but has not yet disclosed the exact number of individuals affected. Available reporting describes the data as encompassing client and employee details stored within the Salesforce environment. The company stated that it immediately launched an investigation and engaged appropriate resources to contain and remediate the breach.