September 2025: Record DDoS Attacks, Salesforce Records Theft, $130M Fintech Fraud & Ransomware Disruption at JLR

September 2025 featured a string of record-breaking cyber incidents, including a Cloudflare-mitigated DDoS peak of 22.2 Tbps and a separate 1.5 billion PPS flood aimed at a European mitigation provider, both driven by botnets of IoT devices and MikroTik routers across thousands of networks.

The ShinyHunters extortion group claimed responsibility for exfiltrating over 1.5 billion Salesforce records via Salesloft Drift tokens, with victims including Google, Cloudflare, Zscaler, and Palo Alto Networks; according to Google Threat Intelligence, analysts warned that related campaigns targeting financial institutions remained active.

Allianz Life disclosed that July’s breach exposed data for about 1.5 million customers via a third‑party CRM, with attribution linked to Scattered Spider, a group associated with multiple Salesforce environment intrusions. WestJet reported a September 2025 breach exposing personal information of around 1.2 million passengers, also linked to Scattered Spider in media reports.

Separately, Sinqia said attackers attempted to divert roughly $130 million through Pix transfers, while Jaguar Land Rover’s cyberattack halted production and prompted a £1.5 billion UK loan guarantee, with the operation attributed to Scattered Lapsus$ Hunters.