Hallmark Cards, Inc. & Hallmark Plus Listed by shinyhunters Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 31 2026 the ransomware group shinyhunters listed Hallmark Cards Inc. on its leak site and claimed to hold internal files taken from the company. The listing states that more than 7.9 million Salesforce records containing personal information and other corporate data were removed during a ransomware operation. The number of individuals affected has not been disclosed and the company has not confirmed the claims.

Incidents of this type continue to occur as threat actors focus on cloud-hosted customer platforms that store large volumes of personal and operational records. When such data appears on leak sites it creates lasting exposure for the people whose information is involved and adds pressure on the affected organisation to respond.

What happened

The listing appeared on 31 March 2026 and described the material as internal files exfiltrated in a ransomware attack. It included a final warning that the data would be released after 2 April 2026 if contact was not made. No independent confirmation of the volume or contents has been published and the scale of any operational impact on Hallmark Cards Inc. remains undisclosed.

The group behind it: shinyhunters

Shinyhunters is a ransomware operator that has repeatedly targeted organisations holding large datasets in cloud environments. The group typically exfiltrates data first and then uses public leak-site postings to pressure victims into payment. Its listings often include claims about record counts and data types drawn from customer-relationship platforms. The current entry for Hallmark Cards Inc. follows this pattern but remains an unverified claim by the group.

Who is Hallmark Cards, Inc.?

Hallmark Cards Inc. is a long-established consumer-products company that designs and sells greeting cards along with related retail and digital offerings. Organisations of this kind routinely maintain customer accounts, purchase histories, loyalty-programme data and employee records. A breach involving such systems can therefore touch both personal details of consumers and internal business information.

What was likely exposed

The group claims that more than 7.9 million Salesforce records containing personally identifiable information and other internal corporate data were taken. The precise fields included in those records have not been confirmed by the company. Organisations that use Salesforce for customer management commonly store names, contact details, transaction histories and account identifiers, yet the exact contents of the claimed exfiltration remain unverified.

What's at stake

Individuals whose records appear in the claimed dataset face the possibility that their personal information could be used for targeted fraud or identity misuse. For the organisation the incident carries risks of regulatory scrutiny, costs associated with investigation and response, and longer-term effects on customer trust. Because the number of people affected is still unknown the full scope of these consequences cannot yet be measured.

Were you affected?

Begin by monitoring official statements from Hallmark Cards Inc. for any guidance on the incident. Review recent account activity for signs of unauthorised access and consider placing fraud alerts with credit agencies if personal financial details may be involved. A free exposure scan of your email address against known breach datasets can indicate whether your information has appeared in previously published collections.

AICompiled with AI assistance from public sources and published under our editorial standards.