Hackers Extorting Salesforce After Stealing Data From Dozens of Customers

SecurityWeek reports that a threat actor group calling itself Scattered LAPSUS$ Hunters has claimed the theft of large volumes of data from dozens of Salesforce customers, listing 39 organisations on a new Tor-based leak site and threatening to leak the data unless Salesforce pays a ransom. The operators, who claim to comprise members of Lapsus$, Scattered Spider and ShinyHunters, say they have stolen roughly 1 billion records from the affected Salesforce instances.

Among the named victims are Adidas, Air France/KLM, Allianz Life, Cisco, Dior, Disney, FedEx, Google, Home Depot, Louis Vuitton, Qantas, Stellantis, Toyota, TransUnion, UPS and Workday. Salesforce, in a notice on its website, states that it has no indication that its platform was hacked and that the claims do not appear related to vulnerabilities in its platform, while noting they are aware of extortion attempts investigated with external experts and authorities.

The piece also quotes AppOmni co-founder Brian Soby, who describes the retirement claims of the related groups as short-lived and highlights social engineering and stolen credentials as likely methods behind the alleged compromises, with the note that these attacks extend to Salesforce itself, according to DataBreaches.