Salesforce says it won’t pay extortion demand in 1 billion records breach

Salesforce has taken a strong stance against an extortion demand from a criminal group claiming to have compromised approximately 1 billion records belonging to numerous Salesforce clients. This threat emerged earlier this year when the group initiated contact with organizations using the Salesforce platform, as reported by Google-owned Mandiant in June. The attackers, who refer to themselves as Scattered LAPSUS$ Hunters, employed a sophisticated tactic involving voice calls aimed at persuading individuals to connect to a malicious application linked to their Salesforce accounts. Disturbingly, several recipients of these calls complied with the attackers' requests. Mandiant identifies this group as UNC6040, as the researchers have yet to establish definitive ties among its members. Earlier this month, the group launched a website listing several high-profile companies, including Toyota and FedEx, along with 37 other Salesforce clients whose data they claim to have accessed. They stated that they had recovered nearly 1 billion records, specifically noting “989.45m/~1B+.” In a bold ultimatum, the website demanded Salesforce enter negotiations for a ransom payment, warning that failure to do so would result in the public release of sensitive customer data. The group insisted that if Salesforce complied with their demands, no other parties would need to pay. They set a payment deadline for the upcoming Friday. In response to the extortion attempt, a Salesforce spokesperson confirmed in an email on Wednesday that the company will not entertain the demands of the extortionists, reinforcing their commitment to protect their customers' data.