Almacenes Silgar · Breach

[Single source] Claim: actor sells Silgar Salesforce admin access, 137K records

Nov 10, 2026 · 1 min read

A threat actor on an underground forum claims to sell full admin access to Spanish firm Almacenes Silgar's Salesforce Sales Cloud plus roughly 137,000 customer records with names, emails, phones and tax IDs. The claim is unverified; customers should watch for fraud attempts using the data.

By HIFY Radar newsroom Updated 11/10/2026 12:13 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Alleged

A seller on an underground forum claims to be offering full administrator access, meaning total control, of the Salesforce Sales Cloud system used by Spanish retailer Almacenes Silgar, packaged with a dataset of roughly 137,000 customer records. The threat intelligence account DailyDarkWeb surfaced the listing on November 10, 2026 and stresses that nothing in it has been verified. Two details argue for caution: the seller's forum account is brand new and the company is described inconsistently, both hallmarks of a possibly padded or recycled offer.

What happened

Alleged

According to DailyDarkWeb, a threat actor, the usual shorthand for a cybercriminal or their proxy, posted a listing on an underground forum advertising data tied to Almacenes Silgar. The seller claims the data was pulled through full admin access to Silgar's Salesforce Sales Cloud, the sales-focused module of the widely used Salesforce customer-management platform.

Alleged

The advertised dataset is described as covering about 137,000 records across several categories: customer accounts with names, contact names, tax ID numbers, emails and phones; billing addresses and preferred language; sales orders with buyer contact details, totals and payment status; and delivery records alongside marketing consent fields.

Why it matters

Inferred

The analyst note attached to the report lays out the practical risk. If the data is authentic, combining tax ID numbers with billing and contact details gives criminals exactly the raw material for convincing invoice fraud, meaning fake bills that look legitimate, and targeted phishing against Silgar's customers.

Inferred

The report also situates this listing inside a wider wave of thefts targeting Salesforce instances, which suggests companies running the platform are facing a repeated pattern rather than a one-off incident. That context raises the baseline plausibility, but it does not verify this specific claim.

What to do

Observed

DailyDarkWeb's bottom line is explicit: treat the listing as an unverified threat-actor claim until independent confirmation appears. No statement from Silgar or any other party exists in the available evidence, so there is no confirmed incident to react to yet.

Inferred

For Silgar customers, the report's fraud analysis points to one practical watchpoint. Be skeptical of unexpected invoices, payment demands or order-related emails that quote your real tax ID or billing details, because that is precisely the scam this kind of data would enable if it turns out to be genuine.

Confirmed and still uncertain

Observed

What is established so far is narrow. A forum listing exists, DailyDarkWeb reported it on November 10, 2026, and the seller makes specific claims about admin access and roughly 137,000 records. That is the entire observed record.

Inferred

Everything that matters is still open: whether the admin access is real, whether any records were actually taken, whether the data is fresh or recycled from an earlier incident, who the seller is, and whether Silgar has investigated. The report states plainly that the claim has not been independently verified, and the new forum account plus the inconsistent company description keep the recycled-claim possibility alive.

What people are saying

Observed

Only one voice appears in this evidence batch. DailyDarkWeb, a threat intelligence account that chronicles underground forum activity, reports the listing and appends an analyst note flagging both the fraud potential of the data and the credibility problems around the seller. The threat actor's own words exist only as relayed by that report, and no statement from Almacenes Silgar appears anywhere in the material.

Evolution

Observed

This story has a single chapter so far. The DailyDarkWeb post of November 10, 2026 is the only public marker in the batch: no follow-up reporting, no confirmation, no denial, no takedown notice. Whether the claim evaporates, gets confirmed or gets recycled into a second listing is the thread to watch next.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Inferred

The credibility signals in the report are themselves telling. The selling account is new to the forum, and the listing describes the target company inconsistently, two patterns that in the analyst's reading can indicate a padded or recycled claim assembled for a quick sale.

Sources and evidence

Observed

This item rests on a single source: DailyDarkWeb's post on X from November 10, 2026, which relays and annotates an underground forum listing rather than republishing it in full. The chain is indirect, one reporter summarizing one anonymous seller, and it carries no independent verification, no corroboration from Silgar and no sample records. Confidence in any specific detail, including the 137,000 figure, should stay low until a second source or the company itself confirms.