Security AffairsPierluigi Paganini
ShinyHunters Launches Data Leak Site: Trinity of Chaos Announces New Ransomware Victims
ShinyHunters-Led Trinity of Chaos launched a Data Leak Site (DLS) on the TOR network, listing 39 firms hit through vulnerabilities in Salesforce and other weaknesses. The group is described as tied to Lapsus$, Scattered Spider and ShinyHunters, continuing coordinated hacks and extortion operations despite claims of retirement.
The victims include Aeromexico, AirFrance, Google, Cisco, Stellantis and Qantas Airlines, with data samples reportedly lacking many passwords but containing substantial amounts of PII, potentially originating from breached Salesforce instances via vishing and stolen OAuth tokens used for Salesloft’s Drift AI chat integration. A recent FBI flash warning urged organisations to monitor technical indicators to detect intrusions into Salesforce environments.
Stellantis disclosed a data breach affecting its North American customers on 21 September 2025, following an attack on Jaguar Land Rover that disrupted retail and production activities. According to Resecurity, the DLS lists updated victims after 10 October, and the group claims the new site will feature over 1.5 billion records.