Scattered Lapsus$ Hunters Returns With Salesforce Leak Site

Scattered Lapsus$ Hunters have returned with a Salesforce-focused leak site, claiming to hold data from Salesforce customers and listing 39 victim organisations. The group says the leak site contains roughly 1 billion records and has set an Oct 10 deadline to publish all stolen data if its demands are not met.

Google has attributed one Salesforce-focused campaign to UNC6040, with the actors using vishing calls to persuade IT staff to grant access to Salesforce environments, while Mandiant researchers note impersonation of third-party vendors and targeted users with elevated SaaS access. The group also mentions a second planned site, dedicated to the UNC6395 Salesloft Drift App campaign, which allegedly used stolen OAuth tokens from Salesloft Drift after its GitHub account was compromised between March and June this year.

Salesforce has issued a status update stating there is no indication the Salesforce platform has been compromised, and they are engaging with affected customers and external experts.