Salesforce says it won’t pay extortion demand in 1 billion records breach

Salesforce says it will not engage with or pay an extortion demand from a crime group claiming to have stolen roughly 1 billion records from Salesforce customers. According to Mandiant, the threat group behind the campaign calls itself Scattered LAPSUS$ Hunters, a mashup of Scattered Spider, LAPSuS$, and ShinyHunters, tracked by researchers as UNC6040.

The group’s campaign began with voice calls to organisations storing data on the Salesforce platform, and a website later named Toyota, FedEx, and 37 other Salesforce customers whose data was said to be stolen, with a claimed total of “989.45m/~1B+” records. A Salesforce representative said in an email that the company will not engage, negotiate with, or pay any extortion demand.

The refusal comes amid a broader rise in ransomware attacks and the controversy over paying ransoms, which supporters say funds criminals while opponents warn it fuels further breaches.