Hacker Alliance Demands Ransom: Scattered LAPSUS$ Hunters Claim 1 Billion Records Stolen from Salesforce

A newly formed cybercrime consortium called Scattered Lapsus$ Hunters (SLSH) claims to have stolen over 1 billion Salesforce records across 39 organisations in a global extortion campaign targeting Salesforce tenants. According to Palo Alto Networks’ Unit 42, threat actors claiming to be part of SLSH have asserted responsibility for the data grab as part of a coordinated effort to steal data and hold it for ransom.

The report notes that the group is a coalition of known groups including Muddled Libra, Bling Libra and LAPSUS$, operating under a shared extortion structure, with Bling Libra believed to be the main orchestrator behind the current wave. Unit 42 confirmed that the attackers posted the names of 39 organisations from which they claim to have stolen Salesforce data and set an October 10, 2025 deadline for ransom payments, warning they would publish the data if victims do not comply.

Salesforce stated it had no intentions of negotiating or paying a ransom. The development highlights a shift from ransomware to extortion-as-a-service models, with Bling Libra described as having operated as an EaaS provider. The report also notes a new group, Crimson Collective, joining extortion campaigns, and that the FBI seized domains linked to BreachForums on 9 October 2025, with Bling Libra saying core members were not arrested.