A leaksear.ch-indexed data leak named ComplianceQuest contains 219 records from an apparent Salesforce CRM or user export, with no breach date listed (leaksear.ch metadata). ComplianceQuest describes itself as a quality, risk, and compliance platform built on Salesforce (www.compliancequest.com).
What happened
leaksear.ch indexed the dataset on October 12, 2026, and the source metadata describes a small export-style set with Salesforce CRM, user, and login-history fields (leaksear.ch metadata).
Public ComplianceQuest materials say the product is built on Salesforce and describe Salesforce data portability through UI-driven and API-driven exports, including reports, APIs, data loader, and third-party ETL tools (www.compliancequest.com). That public context is consistent with the apparent Salesforce export label in the indexed metadata, but it does not identify how this dataset left its source environment.
Attribution remains unconfirmed. The metadata does not name a ransomware group, scraping campaign, misconfigured storage location, third-party provider, or official notification date (leaksear.ch metadata).
What data was exposed
The indexed fields include email addresses, names, usernames, phone numbers, mobile phone numbers, postal addresses, countries, company names, departments, job titles, manager IDs, active-status flags, user types, Salesforce user IDs, IP addresses, login counts, last-login dates, latest-login status, latest-login time, and latest-login URL (leaksear.ch metadata).
leaksear.ch lists address, country, email, IP address, name, phone, and username as searchable pivots for this leak (leaksear.ch metadata). Microsoft’s SalesforceLoginHistory reference describes login-history data as Salesforce login event logs and includes fields such as login time, login URL, source IP, status, and user ID (learn.microsoft.com).
Why this matters
Emails, names, usernames, phone numbers, departments, job titles, company names, and manager IDs can make phishing and business email compromise attempts more convincing because an attacker can reference a real role, team, or reporting line (leaksear.ch metadata).
IP addresses, Salesforce user IDs, login URLs, login counts, and recent login status or time can give account-security teams specific Salesforce access artifacts to review, and they can also make Salesforce-themed sign-in lures look more plausible (leaksear.ch metadata, learn.microsoft.com).
Postal addresses, countries, phone numbers, and mobile phone numbers increase impersonation risk because they add personal context that can be used in account-recovery or customer-support conversations (leaksear.ch metadata).
Readers who want to check their own exposure should search leaksear.ch for this leak using the available pivots: email, name, phone, username, address, country, or IP address (leaksear.ch metadata).
Check your exposure
Request access to check this leak source, or sign in if you already have an account. You can search it by address, country, email, ip address, name, phone, and username.