Hackers Claim Massive Salesforce Breach: 1 Billion Records Stolen

A cybercrime group, Scattered Lapsus$ Hunters (also known as SP1D3R HUNTERS or SLSH), has claimed responsibility for massive data breaches targeting Salesforce customer tenants, with the operation reportedly stealing over one billion Salesforce records across two extortion campaigns.

The attackers, described as a new conglomerate, have named Bling Libra as the primary orchestrator and have dubbed the wider syndicate the “Trinity of Chaos,” comprising members from Muddled Libra (Scattered Spider), Bling Libra (ShinyHunters) and LAPSUS$. The campaign is said to operate an extortion-as-a-service model, offering a revenue share of about 25–30% from extortion payments and shifting focus from traditional data selling to direct victim extortion without deploying file-encrypting malware.

On 3 October 2025 they allegedly launched a data leak site listing 39 global organisations and set an initial ransom deadline for 10 October 2025, with Bling Libra publicly extorting Salesforce but the company reportedly refused to negotiate. The FBI announced on 9 October 2025 that it had seized all BreachForums domains, including the threat actors’ data leak site, though Bling Libra later claimed core members had not been arrested. The story underscores evolving extortion-focused threat models and the ongoing risk to organisations handling large volumes of customer data.