Salesforce data breaches: What companies need to know and do now
Salesforce targeted by cyber attacks
Salesforce is one of the world's leading CRM systems and is used by over 150,000 companies, including many DAX-listed corporations, international airlines, technology companies, and financial service providers. However, its widespread use also makes it an attractive target for cyber attacks. In recent months, there has been a worrying series of security incidents in which Salesforce instances of large companies have been deliberately compromised.
Recent data breaches show that no company is too big to be hacked
In the summer of 2025, a series of high-profile data leaks became public, in which Salesforce was used as a gateway:
- Air France-KLM Group reported an incident in which attackers gained access to frequent flyers' personal data via an external customer service platform – presumably via a manipulated Salesforce integration. Names, phone numbers, and frequent flyer numbers were among the data affected.
- Google confirmed that one of its Salesforce instances had been compromised by a social engineering maneuver. Business data such as customer names and contact information was stolen.
- Allianz Life (USA) had to inform over 1.4 million customers about a data breach. Here, too, a cloud-based CRM platform was the target of the attack.
These attacks do not exploit vulnerabilities in Salesforce itself, but rather use social engineering methods. What makes them particularly insidious is that the attackers circumvent classic security mechanisms such as multi-factor authentication and IP whitelisting. The focus is on accessing plain text data as soon as it reaches Salesforce.
The cause lies in the architecture: data is only protected once it is in the cloud
Many companies rely on Salesforce's own “Shield” solution for data encryption. But there is a key problem with this: the data is only encrypted once it is already in the cloud. This means that it is readable in plain text for Salesforce itself – and potentially also for attackers, authorities, or compromised third-party applications.
In addition, many CRM functions such as search, filter, and sorting remain restricted or unavailable in Shield once data is encrypted. This often presents companies with a conflict of objectives: security or functionality?
The solution: eperi® sEcure protects data before it reaches the cloud
eperi® sEcure for Salesforce picks up where other solutions leave off: it encrypts data within the company before it reaches the Salesforce cloud. This principle is also known as pre-cloud encryption or proxy-based encryption.
Your advantages with eperi® sEcure:
- Plain text data does not leave the company
All sensitive information—from customer data to financial information—is encrypted before it reaches the cloud. Even in the event of an attack on the Salesforce instance, the plain text remains protected. - Full CRM functionality is retained
eperi® sEcure still allows you to search, filter, and validate data—even for encrypted fields. The solution is compatible with Salesforce Lightning as well as mobile and API clients. Even deduplication works despite encryption! - Legal certainty through GDPR and CLOUD Act compliance
Encryption before the cloud prevents US authorities from accessing European company data via the CLOUD Act. The solution also helps to meet data protection requirements from GDPR, ISO 27001, 27701, and §203 StGB (German Criminal Code) as well as industry-specific regulations such as DORA or NIS-2.
Warum clientseitige Verschlüsselung jetzt unverzichtbar ist
In einer Zeit, in der selbst Konzerne wie Google, Air France oder Allianz Opfer gezielter Datenlecks werden, ist der Schutz von Cloud-Daten keine rein technische Frage mehr – sondern eine strategische Pflicht. Cloud-Dienste wie Salesforce bieten hervorragende Funktionalität, doch die Verantwortung für die Datensicherheit bleibt beim Unternehmen selbst.
Nur durch clientseitige Verschlüsselung vor der Cloud lassen sich:
- rechtliche Risiken minimieren (z. B. CLOUD Act, DSGVO)
- externe Zugriffe auf Klartextdaten verhindern
- Cyberversicherungsanforderungen erfüllen
- und Strafen oder Reputationsschäden vermeiden
Conclusion: Use Salesforce – but safely
Salesforce offers undisputed advantages for sales, marketing, and customer service. But security must not be an afterthought. Recent data leaks prove that companies must take their responsibility seriously and act proactively if they don't want to be left behind.
eperi® sEcure offers a proven, patented, and fully integrable encryption solution for using Salesforce securely and in compliance with legal requirements – without restricting CRM functionality.
FAQ – frequently asked questions on the topic
What is the CLOUD Act?
The US CLOUD Act allows US authorities to access data processed by US service providers – even if this data is physically stored outside the US.
Isn't Salesforce Shield sufficient?
Shield only encrypts in the cloud – plain text data remains unprotected until then. In addition, its functionality is limited. eperi® sEcure encrypts before the cloud and retains all important CRM functions.
Is eperi® sEcure GDPR-compliant?
Yes, completely. The solution also helps to meet data protection requirements from ISO 27001, ISO 27701, and industry-specific requirements from §203 StGB, DORA, or NIS-2.
Did you like this article?
Then like it now or share it with colleagues, business partners, and friends.
Insure against cyber risks
Cyber attacks have long been part of everyday life - but anyone hoping for support from their cyber insurance in an emergency must now more than ever provide concrete proof of security. Encryption is no longer a "nice to have", but a prerequisite. In our white paper, you can find out what the current AVB Cyber 2024 requirements are, what insurers pay particular attention to and how you can demonstrably protect your data with eperi sEcure.
Prepare your company optimally - before a claim occurs. Download now free of charge and make an informed decision.
