Hackers Launch Leak Portal to Publish Data Stolen from Salesforce Instances

The article reports that a hacker collective styling itself “Scattered Lapsus$ Hunters” has launched an extortionware portal aimed at pressuring victims to delist and delete stolen data, with the leverage centred on Salesforce datasets after months of intrusions via social engineering, OAuth abuse and downstream supply chain compromise. The group unveiled the TOR-hosted portal on 3 October 2025, setting an October 10 deadline for payments and threatening publication if demands are unmet.

The attackers’ approach relied on a combination of tricking users into authorising malicious Salesforce integrations and abusing OAuth tokens obtained via a compromised provider, enabling broad API access across targets to harvest data at scale. The campaign’s evolution has been traced from voice-phishing to a data-theft operation tied to Drift and Salesforce, with the threat path later linked to OAuth token abuse that enabled widespread access, according to Google’s threat intelligence team.

Salesforce has stated there is no indication of a platform compromise or vulnerability exploitation, emphasising social engineering, token abuse and supply‑chain weaknesses as the primary risk. The leak site catalogues organisations and purported data volumes, highlighting the impact of sensitive customer, pipeline and deal metadata.