Cybercrime gangs launches extortion campaign on Salesforce customers

A coalition of cybercriminal groups calling themselves "Scattered Lapsus$ Hunters" has launched an extortion campaign targeting Salesforce customers, claiming to have stolen approximately one billion records from companies storing their customer and corporate data in Salesforce cloud databases. 

On October 3, 2025, the threat actors published a dark web data leak site listing 39 victim organizations and threatening to release their stolen data publicly unless ransom demands are met by an October 10, 2025 deadline. 

It seems that the threats relate to the breached Salesforce instances through voice phishing and malicious OAuth Connected Apps abuse in September. 

In a separate but related campaign discovered in August 2025, the threat actors exploited stolen OAuth tokens from Salesloft's Drift AI chat integration with Salesforce. This attack impacted approximately 760 companies and resulted in the theft of an estimated 1.5 billion Salesforce records. 

The data leak site launched on October 3, 2025, lists 39 confirmed victim organizations, including major global brands such as 

• FedEx,
• Disney/Hulu,
• Home Depot,
• Marriott,
• Google,
• Cisco,
• Toyota,
• Gap,
• McDonald's,
• Walgreens,
• Instacart,
• Cartier,
• Adidas,
• Saks Fifth Avenue,
• Air France & KLM,
• TransUnion,
• HBO Max,
• UPS,
• Chanel,
• IKEA,
• KFC,
• Albertsons. 

ShinyHunters representatives told media outlets that "there are numerous other companies that have not been listed," suggesting the actual number of victims significantly exceeds those publicly disclosed. Several companies have confirmed breaches, including Allianz Life (1.1 million customers impacted), Farmers Insurance (1.1 million customers), TransUnion (4.4 million individuals), Google, Cisco, Qantas Airways, Adidas, Chanel, Pandora, Workday, and automotive giant Stellantis.

The extortion demands include a ransom request to Salesforce CEO Marc Benioff for 20 Bitcoin, with the threat actors promising to withdraw all individual extortion attempts against Salesforce customers if the company pays. "Contact us to negociate [sic] this ransom or all your customers data will be leaked," the message on the leak site states. "If we come to a resolution all individual extortions again your customers will be withdrawn from. Nobody else will have to pay us, if you pay, Salesforce, Inc." The threat actors also warned they would assist law firms in pursuing civil and commercial lawsuits against Salesforce for alleged failures to protect customer data as required under the European General Data Protection Regulation (GDPR).

Salesforce issued a statement on its status update site declaring: "We are aware of recent extortion attempts by threat actors, which we have investigated in partnership with external experts and authorities. Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support. At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology." 

The company emphasized that the breaches resulted from social engineering attacks targeting individual customer environments rather than from any technical flaws in the Salesforce infrastructure.

Update - as of 8th of October 2025, Salesforce notified customers it will not pay ransom to the hackers threatening to publish data stolen from customer instances. Per an internal memo seen by Bloomberg, Salesforce is aware that the hacker group ShinyHunters plans to publish some of the stolen information. Salesforce claims that it will not negotiate or comply with any form of extortion.

As of 10th of October 2025 Scattered Lapsus$ Hunters leaked some of the stolen Salesforce data.

• Qantas Airways Limited - 153 GB
• Vietnam Airlines - 63.62 GB
• Albertsons Companies, Inc. - 2 GB
• GAP, INC. - 1 GB
• Fujifilm - 155MB
• Engie Resources - 3 GB

,