Pitney Bowes pitneybowes.com Pitney Bowes data breach: what happened and what to do
Attackers got into Pitney Bowes's Salesforce customer records in April 2026. Have I Been Pwned lists 8,243,989 accounts, with email addresses, names, phone numbers, physical addresses and job titles exposed. No passwords are listed.
View all 13,115 breaches- Breach date
- 20 Apr 2026
- Made public
- 9 Apr 2026
- Affected
- 8,243,989
- Data exposed
- Email addresses, Job titles, Names, Phone numbers, Physical addresses
- Verified
- Yes
- Last updated
Source: Have I Been Pwned (CC BY 4.0)
Pitney Bowes, the mailing and shipping technology company, had customer records taken from its Salesforce environment in April 2026. Have I Been Pwned (HIBP) says the breach date was 20 April 2026 and added it to its database on 27 April 2026. HIBP counts 8,243,989 accounts.
What happened
Pitney Bowes told The Register that it found unauthorized access to certain records in its Salesforce customer relationship management environment on 9 April. The company said the intrusion happened the night before and came from a phishing attack that compromised an employee's email account.
The extortion group ShinyHunters claimed the attack. HIBP says the group's demands weren't met and the data was then published. The group's own claim of more than 25 million records is a claim, not a verified count. The figure to use is HIBP's 8,243,989 accounts.
What was exposed
HIBP lists email addresses, names, phone numbers, physical addresses and job titles. A subset of the data also covered Pitney Bowes employee records. Passwords are not on the list.
Customer relationship records like these are mostly business contacts: who works where, what their role is, how to reach them. That is exactly what a scammer needs to write a believable message.
What that lets criminals do
A name, a job title, an employer and a phone number make a convincing pretext. Expect fake invoices, fake shipping or postage notices, and calls from someone who sounds like they know your account. Pitney Bowes is a name people associate with postage and mailing, so a message about a postage meter or a delivery problem will look plausible.
A physical address adds a second layer. It lets a scammer mail you something, or confirm that a person really lives at an address before targeting them further.
Because no passwords were exposed, you don't need to assume your Pitney Bowes login was stolen. The risk here is social engineering, not account takeover.
The company's response
Pitney Bowes said it identified the unauthorized access on 9 April and described the entry point as a phishing attack on an employee account. The Register reported the company's statement; a full public notice with every detail wasn't available from the sources reviewed. HIBP's entry is the best single place to check your own email address.
If you dealt with Pitney Bowes
If you're a customer or a contact at a company that is, assume your work email and phone number are now in circulation. Tell colleagues who handle invoices and shipping that messages quoting Pitney Bowes need a second check before anyone acts on them.
How to check your own exposure
Search your work and personal email addresses on Have I Been Pwned. If an address shows up, the entry tells you which data types came with it. For a business contact list like this one, the useful question is which of your details are now tied together: your name, your employer, your job title and your phone number. Those four together are what an impersonator uses. It's worth telling a manager or an IT contact if you handle payments or vendor accounts, because a fraud attempt there costs more than a spam email does.
What to do if you were in it
- 1
Expect phishing that mentions the breach
Treat unexpected emails, texts and calls with suspicion, especially ones that quote your name, phone number or the company. Don't click links in them. Go to the company's site yourself, or call the number printed on a card or a bill.
- 2
Verify any request about postage, invoices or shipping
If a message asks you to pay, update bank details or log in to a Pitney Bowes account, contact the company through its own website or a number you already have. Never use the contact details in the message.
- 3
Warn your colleagues
The data includes job titles and employers. If you work in finance, mailroom or procurement, tell your team that fraud attempts quoting this breach are likely.
- 4
Be careful with unexpected mail and calls to your address and number
Your physical address and phone number are in the data. Don't confirm personal details to an unsolicited caller.
- 5
Check whether your email or phone is in this and other breaches
Run a free scan at Serus to see which breaches include your email address or phone number. Breach data can't be taken back once it's out, so the scan tells you what to change and where to stay alert.
Frequently asked
Was I affected by the Pitney Bowes data breach?
Search your email address on Have I Been Pwned. HIBP lists 8,243,989 accounts in this breach. A Serus free scan also checks your email and phone number against this and other breaches.
What was exposed in the Pitney Bowes breach?
Email addresses, names, phone numbers, physical addresses and job titles. HIBP doesn't list passwords.
Should I change my password?
No passwords are listed, so this breach alone doesn't call for it. If you reuse passwords across sites, changing them is still a good idea.
Who was behind it?
ShinyHunters claimed the attack. Pitney Bowes told The Register the intrusion came from a phishing attack that compromised an employee email account.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
