Hacking group claims theft of 1 billion records from Salesforce customer databases

A well-known hacking collective has made headlines by launching a new website aimed at extorting victims, declaring it has stolen approximately one billion records from businesses utilizing Salesforce's cloud databases. This loosely affiliated group, operating under names such as Lapsus$, Scattered Spider, and ShinyHunters, has unveiled a data leak site on the dark web named Scattered LAPSUS$ Hunters. Discovered by cybersecurity analysts last Friday and reported by TechCrunch, the site serves as a platform for the hackers to coerce their targets into paying a ransom to prevent the public release of their sensitive data. "Contact us to regain control on data governance and prevent public disclosure of your data," the site states ominously. The hackers warn potential victims, "Do not be the next headline," and claim that all communications will be treated with utmost confidentiality. In recent weeks, the ShinyHunters group has allegedly infiltrated numerous high-profile organizations by breaching their Salesforce-hosted cloud databases. Major firms, including Allianz Life, Google, fashion giant Kering, airline Qantas, auto manufacturer Stellantis, credit agency TransUnion, and HR platform Workday, have confirmed that their data has been compromised during these extensive hacks. The hackers' leak site also identifies several alleged victims, such as FedEx, Hulu (a Disney subsidiary), and Toyota Motors, all of whom declined to comment when approached on Friday. It remains uncertain whether some companies, not explicitly named on the hackers’ site, have paid ransoms to keep their data under wraps. The hackers have called out Salesforce directly, demanding negotiations over a ransom and warning that failure to comply would result in the exposure of customer information. This ultimatum hints that Salesforce has not yet responded to the hackers' demands. Despite inquiries from TechCrunch, Salesforce representatives have not commented on the situation or the breach itself. Security experts have long speculated that this group, which has traditionally avoided a visible online footprint, was preparing to create a data leak site for extortion purposes. This strategy aligns with a growing trend among cybercriminal organizations, which have shifted from merely encrypting victims' data and demanding ransoms to threatening public disclosure of stolen information if their demands are not met.