Extortion Group Leaks Millions of Records From Salesforce Hacks

The Scattered LAPSUS$ Hunters extortion group, described as an offshoot of Lapsus$, has leaked millions of records allegedly stolen in a Salesforce-targeting campaign, with data purportedly covering Albertsons, Engie Resources, Fujifilm, GAP, Qantas and Vietnam Airlines. The leak followed the group’s claim that they had stolen data from 39 Salesforce customers and would publish it unless Salesforce paid a ransom, a claim Salesforce has denied, saying the incident related to past or unsubstantiated events.

The data included names, email addresses, phone numbers, dates of birth and loyalty-program details, and some of the victims’ information was later made available on their leak site before being posted for free on another surface. The disclosure also notes that Vietnam Airlines data linked to roughly 7.3 million accounts was associated with the incident, and that the data were reportedly stolen from the company’s Salesforce instance in June this year, according to Have I Been Pwned.

In July, the Australian airline said roughly 6 million customers might have been affected, with data tied to a third‑party contact centre platform. Quantas confirmed it was analysing the leak with cybersecurity experts after obtaining a court injunction to block access to the stolen information.