Baker Distributing data breach: 102K accounts exposed
Severity: medium · Patch status: no-fix-needed · Since 2026-06-07
In May 2026, the HVAC/R wholesale distributor Baker Distributing Company was added to the ShinyHunters data extortion group's "pay or leak" site. In early June, the group publicly published data they claimed had been obtained from Baker's SharePoint and Salesforce infrastructure including 103k unique email addresses along with names, physical addresses, phone numbers and tickets relating to the company's HVAC contractor customer base. The exposed data was largely corporate contact and support information with limited sensitivity. Exposed data: email addresses, names, phone numbers, physical addresses, support tickets. The breach dates from May 23, 2026; Have I Been Pwned loaded it on Jun 7, 2026.
What to do
- If you had a Baker Distributing account, change its password and the password of any other account that reused it.
- Turn on multi-factor authentication wherever it is offered.
- Check whether your addresses are in this breach at https://haveibeenpwned.com.
- Expect targeted phishing that quotes the leaked details; verify any unexpected contact out of band.
Sources
All live incidents on Threat Watch
