Trinity of Chaos Leaks Data from 39 Companies — Google, Cisco Among Targets

A new ransomware collective calling itself the Trinity of Chaos has published a data leak site on the TOR network exposing the stolen records of 39 prominent corporations, including Google Adsense and Cisco.

The alliance, which comprises threat actors from Lapsus$, Scattered Spider and ShinyHunters, has released data samples from past breaches rather than claiming fresh intrusions, and highlighted an incident where Salesforce was allegedly exploited via stolen OAuth tokens tied to Salesloft’s Drift AI chat integration. Salesforce downplayed the claims but acknowledged potential compromises of customer environments, with threat actors reportedly seeking negotiations to avoid disclosure.

The group has urged that after 10 October it will expand the leak site to include over 1.5 billion records from 760 companies if its demands are unmet, according to Resecurity’s threat intelligence team. Past victims named include Vietnam Airlines and the National Credit Information Center of Vietnam, while breaches at Noi Bai and Tan Son Nhat airports are also mentioned; in Cisco’s case, Salesforce records reportedly revealed internal communications and data on US and international defence personnel.