Salesforce Sales Cloud da Immigration and… · Breach

[Single source] Actor claims Salesforce admin access at Canada's IRB

Nov 10, 2026 · 1 min read

A threat actor claims to be selling administrator access to the Immigration and Refugee Board of Canada's Salesforce Sales Cloud instance, along with about 137,000 records. The alleged data includes contact and refugee protection claim information. The agency should verify the access and review administrative credentials.

By HIFY Radar newsroom Updated 11/10/2026 02:39 PM Get this every day →← Back to the feed 1 source

HighBreachNo software to update

In 30 seconds

Alleged

DailyDarkWeb reports that an underground forum account is offering alleged administrator access to a Salesforce Sales Cloud environment tied to Canada's Immigration and Refugee Board, together with roughly 137,000 records. The report stresses that the claim is unverified, the seller is a new account with little reputation, and the IRB had not commented.

What happened

Alleged

According to DailyDarkWeb, the forum listing claims to include contact records for claimants, appellants, counsel and other participants, plus refugee protection claim details such as names, birth dates, contact information, alleged country of persecution, and hearing and decision dates. Accommodation and interpretation requests are also allegedly included.

Why it matters

Inferred

If authentic, the material could expose people involved in refugee proceedings through identity, contact, case and accessibility information. DailyDarkWeb characterizes refugee claimant data as exceptionally sensitive, but the available evidence does not establish that the records are genuine or were taken from the IRB.

What to do

Inferred

The prudent response is to verify whether the advertised tenant and records are authentic before treating this as a confirmed breach. That review should establish the tenant's relationship to the IRB and determine whether any administrator account or claimant data was exposed.

Confirmed and still uncertain

Observed

What is observed is a public report describing an underground listing. It remains unknown whether the seller has working access, whether the roughly 137,000 records exist as described, who owns the named tenant, how any access was obtained, or whether IRB systems or data were compromised.

What people are saying

Observed

DailyDarkWeb explicitly says the claim has not been independently verified and should not be treated as a confirmed breach. It also says the IRB had not commented on the listing when the post was published.

Evolution

Alleged

The reported chain begins with a new, low reputation forum account allegedly advertising access and data. DailyDarkWeb then publicized the listing while adding strong caveats about authenticity and the absence of an IRB response. No later confirmation appears in the supplied evidence.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The offer is described as full administrator access to a Salesforce Sales Cloud instance. The listing reportedly names a third party tenant rather than an IRB system, so the technical and contractual connection between that environment and the agency remains unresolved.

Sources and evidence

Observed

The supplied evidence consists of one DailyDarkWeb post summarizing an alleged underground forum listing and displaying an associated image. It provides no independent validation, agency statement, forensic findings or direct proof that the advertised access works, so attribution and compromise claims remain unconfirmed.