Hallmark hallmark.com Hallmark data breach: what happened and what to do
In March 2026, attackers allegedly took Hallmark data from Salesforce and published it after an extortion deadline passed. Have I Been Pwned added 1.7 million email addresses, with names, phone numbers, addresses and support tickets.
View all 13,115 breaches- Breach date
- 31 Mar 2026
- Affected
- 1,736,520
- Data exposed
- Email addresses, Names, Phone numbers, Physical addresses, Support tickets
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
What happened
Have I Been Pwned (HIBP) describes an alleged breach of Hallmark in March 2026. Attackers reportedly got into data stored in Salesforce, a customer-management platform, and demanded payment. When the deadline passed, the data was published. HIBP dates the incident to 31 March 2026 and added the data on 12 April 2026.
The data covers both Hallmark and Hallmark+, the company's streaming service. HIBP counted 1,736,520 accounts, with about 1.7 million unique email addresses. The extortion group ShinyHunters, named in Cybernews coverage, claimed far more, about 7.9 million Salesforce records. Salesforce Ben reported that the group set an April deadline before leaking. HIBP's figure counts unique email addresses actually found in the published data, which is why it is lower than the claim.
Salesforce told Salesforce Ben it had no indication that the issue came from a vulnerability in its platform.
What was exposed
HIBP lists these data types:
- Email addresses
- Names
- Phone numbers
- Physical addresses
- Support tickets
Support tickets are messages between customers and Hallmark's support team. They can contain whatever people wrote: order numbers, complaints, details about gifts and recipients. Hallmark is a company people use to send cards to relatives, so names and addresses of other people can show up in tickets.
HIBP's entry doesn't list passwords or payment card details.
What this lets criminals do
A name, a home address, a phone number and an email form a ready-made profile. With a support ticket attached, a scammer knows what you bought or complained about. That makes a fake "Hallmark order problem" email or text look genuine.
Expect these kinds of messages:
- A text that says a card or gift order couldn't be delivered and asks you to confirm your address on a link
- An email claiming a Hallmark+ subscription payment failed
- A call from someone who quotes your address and says they are from customer service
Your home address is also useful for mail scams and for a fraudster who needs to look like they know you.
The company's response
HIBP labels this breach as alleged, which is its wording when a company hasn't confirmed all the details. The coverage cited here is based on the extortion group's claims and on HIBP's analysis of the published data. If Hallmark contacts you, go to the company's site yourself rather than following a link in the message.
What you can still do
Your address and phone number have been exposed before, in other breaches, and this adds to the pile. The steps below are about making the data less useful: don't trust unexpected messages about orders, keep passwords unique, and turn on two-factor login on the Hallmark and Hallmark+ accounts and your email.
What to do if you were in it
- 1
Don't trust messages about Hallmark orders or subscriptions
Texts and emails about failed deliveries or payments that link to a login page are a common scam. Open the Hallmark or Hallmark+ site yourself.
- 2
Change your Hallmark password and turn on two-factor login
HIBP doesn't list passwords here, but changing it is quick. Replace it anywhere you used the same one.
- 3
Think about what you wrote in support tickets
If you shared details about other people, such as recipients' names or addresses, they may be exposed too. Consider telling them.
- 4
Be cautious with calls that know your address
A caller who quotes your address and phone number isn't proof of who they are. Hang up and call the company on a number you looked up.
- 5
Treat messages that mention the breach as suspect
Expect emails and texts that quote your name or details to look convincing. Don't click links in them; open the company's site yourself. Our guide to stopping spam emails helps with the flood.
- 6
Check which other breaches include you
Run a free Serus scan to see whether your email or phone number appears in this and other breaches. Serus monitors breach databases and the dark web and alerts you when your details show up in a new leak.
Frequently asked
Was I affected by the Hallmark data breach?
Look up your email on Have I Been Pwned. If Hallmark is listed, your email and other details from the published data were exposed.
What was exposed?
Email addresses, names, phone numbers, physical addresses and support tickets, according to Have I Been Pwned.
Does this include Hallmark+ customers?
Yes. HIBP says the 1.7 million email addresses cover both Hallmark and the Hallmark+ streaming service.
Should I change my password?
HIBP doesn't list passwords in this breach. Changing yours and turning on two-factor login is still a quick precaution.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
