What Happened
In the 2026 Sysco.com data breach, threat actor group ShinyHunters claimed to have stolen over 61 million Salesforce records from Sysco, exposing extensive customer and employee personally identifiable information (PII) including names, phone numbers, and street addresses. Dark web monitoring sites first reported Sysco as a victim around May 7, 2026, with breach data dated May 4, 2026. A breach listing indicates about 1,709,807 rows of data were found, containing contact and address details. At the time of reporting, law firms and investigators noted that Sysco’s incident was still under investigation and that full details, including precise record counts and any additional data types exposed, had not yet been formally confirmed by the company.
