What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Stellantis confirmed a customer-data breach on September 22, 2025. Unauthorized actors accessed a third-party platform supporting the automaker’s North American customer-service operations and took customer contact information. Stellantis later said the platform did not store financial or sensitive personal information.
Independent reporting linked the event to a wider Salesforce-connected-application campaign, but that does not establish that Salesforce’s core platform was exploited. The alleged 18-million-record figure and the exact data fields remain unconfirmed.
As an Amazon Associate I earn from qualifying purchases.
What Stellantis confirmed
Stellantis confirmed on September 22, 2025, that unauthorized actors accessed a third-party service-provider platform used for its North American customer-service operations. The company said customer contact information was taken.
Free tools Windows power users keep installed
One-click scans. No signup required.
That is the confirmed core of the incident. Stellantis later said in its 2025 annual report that the affected platform did not store financial or sensitive personal information. The company also said it had not been materially affected by the event, while acknowledging that a serious incident at a major supplier or service provider could create operational and reputational risk.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
The disclosure applies to the affected customer-service environment—not automatically to every Stellantis brand, every customer worldwide, or Stellantis vehicle systems. Stellantis owns brands including Jeep, Ram, Chrysler, Dodge, Fiat, Maserati, Peugeot, Opel, and Vauxhall, but the public information reviewed identifies the affected business function as North American customer service.
What data was exposed?
Stellantis described the exposed category as customer contact information. That wording does not provide a field-by-field inventory. The reviewed company disclosures do not establish whether the data included names, email addresses, telephone numbers, postal addresses, vehicle-identification details, service histories, or other customer-service metadata.
It is therefore accurate to say that contact information was taken. It is not accurate to state, without a later Stellantis notice, that Social Security numbers, payment-card data, driver’s-license numbers, vehicle telematics, or detailed service records were stolen. Stellantis’s annual-report description specifically says the affected platform did not store financial or sensitive personal information.
| Question | What the public record establishes |
|---|---|
| Who was affected? | A third-party platform supporting Stellantis’s North American customer-service operations. |
| What was taken? | Customer contact information. |
| How many people? | No definitive number of affected individuals or records has been confirmed by Stellantis in the reviewed disclosures. |
| Were financial details exposed? | Stellantis said the affected platform did not store financial or sensitive personal information. |
| Were vehicle-control or connected-car systems accessed? | The reviewed disclosures do not establish access to vehicle controls, telematics, manufacturing systems, or other automotive operational systems. |
Why the incident is being called a Salesforce hack
Independent reporting connected the Stellantis incident to a wider 2025 campaign involving Salesforce customer environments and third-party application access. The threat group ShinyHunters was reported as claiming responsibility, and one report attributed an alleged figure of approximately 18 million customer records to the attackers.
Rank #2
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Those details require careful qualification. Stellantis did not confirm the 18-million-record figure in the company material reviewed here, and an attacker’s claim is not proof of the final number of affected people. The exact intrusion path into Stellantis’s service-provider environment has also not been publicly established.
Most importantly, the available evidence does not establish that attackers exploited a vulnerability in Salesforce’s core platform. Salesforce’s notices about related activity described unusual access through a third-party connected application and distinguished that activity from a vulnerability in the core Salesforce service. The more precise description is that Stellantis confirmed a breach involving a third-party customer-service platform, while reporting linked it to a broader Salesforce-connected-application campaign.
How the broader Salesforce campaign unfolded
Salesforce’s Trust Status notices provide context, but they do not constitute a Stellantis-specific forensic report. In the related Drift incident, Salesforce said a third-party application connection installed by individual customers was involved in unusual activity that may have enabled unauthorized access to data belonging to a small number of customer organizations. Salesforce disabled the connection, invalidated active and refresh tokens, and said the issue did not originate from a vulnerability in the core Salesforce platform.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsSalesforce later advised customers to inventory non-Salesforce applications, scrutinize OAuth-connected applications, rotate consumer secrets and tokens where appropriate, enforce suitable IP controls, and maintain a current security contact and incident-response process. Later Salesforce guidance in 2026 also emphasized multifactor authentication, least privilege, and careful management of connected applications. Salesforce said the platform itself had not been compromised in the social-engineering incidents discussed in that guidance.
Rank #3
- 【Upgraded version】 - The mirror logo strip is combined with the striped non-slip design. The rounded corners of the shell are more suitable for holding. The strips play a heat dissipation function to ensure a stable and fast transmission process.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
A separate 2026 FINRA alert discussed misconfigured Salesforce Experience Cloud guest-user access. That alert is relevant because it illustrates another way a Salesforce customer environment can expose data through identity or configuration weaknesses. It is not evidence that the Stellantis incident used Experience Cloud guest access, and it should not be presented as the confirmed cause here.
Stellantis breach timeline
| Date | What happened |
|---|---|
| During 2025 | Stellantis detected unauthorized access to a third-party platform supporting North American customer service. Its later annual-report description said the platform did not store financial or sensitive personal information. |
| August 26, 2025 | Salesforce posted a security notice about unusual activity involving a third-party connected application. |
| August 28, 2025 | Salesforce disabled integrations involving the Drift application as a precaution while it investigated. |
| September 7, 2025 | Salesforce reported that it had re-enabled Salesloft integrations, except for Drift, after remediation measures were implemented and independently validated, according to its Trust Status notice. |
| September 22, 2025 | Public reporting identified Stellantis as a confirmed victim and described the exposed information as customer contact data. |
| Later company reporting | Stellantis’s 2025 annual report described the affected platform as not storing financial or sensitive personal information and said the event had not materially affected the company. |
| 2026 | Salesforce and regulators continued publishing guidance on connected applications, OAuth, social engineering, Experience Cloud access controls, and third-party risk. |
What Stellantis customers should do
Contact information alone does not prove that a person’s financial accounts or vehicle systems were compromised. It can still make targeted impersonation more convincing, particularly when the sender claims to represent an automaker, dealer, warranty department, recall team, or service center.
- Be skeptical of unexpected messages. Treat unsolicited emails, texts, and calls about recalls, service appointments, warranty coverage, account verification, refunds, or vehicle payments as potentially fraudulent.
- Verify independently. Do not use the phone number, link, or reply address in a suspicious message. Navigate to the official Stellantis or relevant brand website yourself, use an established customer account, or contact a dealer through a number you already trust.
- Do not provide additional credentials. A legitimate support representative should not need your password, multifactor authentication code, payment-card PIN, or other one-time security code. Do not upload identity documents merely because an unsolicited message requests them.
- Review accounts only when the notice supports it. If Stellantis later confirms that login credentials or account data were involved, change the affected password and any reused password, and enable multifactor authentication. The current public disclosure does not establish that passwords were exposed.
- Do not assume credit monitoring is required. The reviewed disclosures describe contact information and say the affected platform did not store financial or sensitive personal information. If a later official notice identifies government identification numbers or financial data, follow that notice’s specific instructions.
- Report suspicious activity. Preserve the message, sender details, phone number, and web address, then report the attempt through the relevant platform, email provider, financial institution, or law-enforcement reporting channel.
No reviewed source establishes that Stellantis offered a particular credit-monitoring or identity-monitoring service to customers affected by this incident. Consumers should be especially cautious of unsolicited offers claiming to provide official breach assistance.
Recommended Free Tools
What Salesforce administrators and automakers should review
The incident is a useful reminder that a secure SaaS platform can still be placed at risk by connected applications, stolen OAuth tokens, excessive permissions, social engineering, or customer-side configuration. Salesforce’s recommendations support the following review:
Rank #4
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
- Inventory every connected application. Identify all non-Salesforce applications connected to production orgs, customer-service systems, portals, marketing tools, analytics services, and integration middleware. Include applications installed by individual users, not just centrally approved software.
- Review OAuth permissions and usage. Check which users, service accounts, and applications can read or modify customer data. Look for unused applications, excessive scopes, unusual authorization times, unfamiliar IP addresses, and access that does not match the application’s business purpose.
- Remove or disable unnecessary connections. Do not leave an application authorized simply because it was approved in the past. Revoke access for abandoned integrations and investigate any application that cannot be verified with its owner and vendor.
- Rotate secrets and tokens after suspected exposure. Rotate consumer secrets and relevant access or refresh tokens when an application, account, or vendor relationship may have been compromised. Token invalidation should be paired with a review of how the integration obtained and stored replacement credentials.
- Enforce multifactor authentication and least privilege. Require MFA where supported, limit administrator permissions, separate duties, and give integrations only the records and actions they need. A service account with broad read access can turn a small integration compromise into a large data-exposure event.
- Use appropriate network restrictions. Review IP controls and other access policies for administrative users, integrations, and customer portals. Controls should fit the organization’s operating model; an overly broad allowlist can provide a false sense of security.
- Audit guest and portal access. Review Experience Cloud guest-user permissions, public pages, sharing rules, Apex or API exposure, and unauthenticated endpoints. The FINRA alert makes this a worthwhile control review, but it does not prove that this was Stellantis’s attack path.
- Improve detection and response. Retain authentication, OAuth, API, and connected-application logs long enough to investigate. Define who owns each integration, keep a current security contact, and maintain a response plan that includes token revocation and vendor coordination.
- Assess service providers as part of the attack surface. A vendor may operate the platform that handles customer interactions even when the automaker does not operate the underlying infrastructure. Contracts and reviews should address access controls, breach notification, logging, subcontractors, data retention, and application changes.
Organizations that cannot independently validate those controls should consider an independent Salesforce security assessment focused on connected applications, OAuth permissions, portal configuration, and third-party access. That is a general defensive option—not evidence that Stellantis used any particular vendor or that every Salesforce customer requires the same remediation.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What remains unknown
- Final number of affected records: The approximately 18 million figure came from external reporting about an alleged attacker claim. Stellantis has not confirmed it in the reviewed disclosures.
- Exact data fields: The public description does not identify whether names, email addresses, telephone numbers, postal addresses, vehicle information, or service details were included.
- Exact technical route: The broader Salesforce-connected-application context is documented, but a complete Stellantis-specific forensic explanation has not been publicly provided in the reviewed material.
- Individual notification scope: The reviewed sources do not provide a final customer-by-customer notification count or a public field-level notice that resolves the uncertainty.
- Impact beyond customer service: Nothing in the reviewed disclosures establishes access to vehicle controls, connected-car systems, manufacturing operations, or all Stellantis customer databases.
Bottom line
Stellantis confirmed a breach of customer contact information through a third-party platform supporting North American customer service. Public reporting linked the event to a wider Salesforce-related campaign, but the evidence does not show a confirmed vulnerability or direct compromise of Salesforce’s core infrastructure. The 18-million-record figure, the precise data fields, the attackers’ attribution, and the exact intrusion path remain unconfirmed.
For consumers, the practical risk is convincing phishing and impersonation using automaker-related themes. For Salesforce users and vehicle companies, the larger lesson is to treat connected applications, OAuth access, tokens, portal permissions, and service providers as part of the security boundary.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteFrequently Asked Questions
Was Salesforce’s core platform hacked?
No confirmed core-platform exploit has been established. Salesforce’s notices about related 2025 activity described unauthorized access involving a third-party connected application and distinguished it from a vulnerability in Salesforce’s core service. The Stellantis-specific technical route remains unconfirmed.
What Stellantis customer data was stolen?
Stellantis confirmed that customer contact information was taken from a third-party platform supporting North American customer service. The company later said the platform did not store financial or sensitive personal information. The exact fields have not been publicly itemized in the reviewed disclosures.
Were all Stellantis customers affected?
No. The reviewed public disclosures do not establish that all Stellantis customers, all brands, or customers outside North America were affected. The confirmed scope is the third-party platform supporting North American customer-service operations.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Did the breach affect 18 million Stellantis customers?
Not according to Stellantis’s confirmed public disclosure. The approximately 18 million figure was attributed in independent reporting to an alleged attacker claim and was not confirmed by Stellantis in the reviewed company material.
What should Salesforce administrators do after this incident?
Organizations should inventory connected applications, review OAuth permissions and logs, disable unnecessary integrations, rotate secrets and tokens after suspected exposure, enforce MFA and least privilege, review IP controls, audit portal guest access, and maintain a current incident-response process.
The Bottom Line
Stellantis confirmed that unauthorized actors obtained customer contact information from a third-party platform supporting North American customer service. The public record does not confirm 18 million affected records, specific sensitive fields, or a vulnerability in Salesforce’s core platform; it instead points to the broader risks of connected applications, OAuth access, identity controls, and customer-side configuration.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
