Feds Shutter ShinyHunters Salesforce Extortion Site

The FBI, in coordination with law enforcement in France, seized the latest BreachForums underground forum domain, which had been converted into an extortion site used by Scattered Lapsus$ Hunters, the group behind the recent Salesforce data heists.

The attackers, described as an apparent combination of Scattered Spider, Lapsus$, and ShinyHunters, have been active in compromising Salesforce data and warned that Salesforce victims have until midnight ET on 10 October to meet ransom demands before records are published. Despite the BreachForums seizure, the group’s Tor Dark Web site remains accessible and will be used to leak data.

Salesforce has issued its own statement, acknowledging the extortion attempts and reiterating that there is no indication the Salesforce platform itself had been compromised, according to Salesforce. The attackers list claims of having 1 billion records and 39 victim organisations, with sample names including Chanel, Disney and Hulu, Marriott, Google, Toyota and FedEx.

BreachForums’ seizure has not ended the threat, as the group frames the action as part of an ongoing crackdown by authorities, with the era of forums described as over.