{"id":7324,"date":"2025-10-04T08:35:48","date_gmt":"2025-10-04T08:35:48","guid":{"rendered":"https:\/\/techtrendfeed.com\/?p=7324"},"modified":"2025-10-04T08:35:48","modified_gmt":"2025-10-04T08:35:48","slug":"scattered-lapsus-hunters-declare-salesforce-breach-1b-information-39-companies-listed","status":"publish","type":"post","link":"https:\/\/techtrendfeed.com\/?p=7324","title":{"rendered":"Scattered LAPSUS$ Hunters Declare Salesforce Breach, 1B Information, 39 Companies Listed"},"content":{"rendered":"


\n<\/p>\n

\n

A brand new leak web site has gone dwell, operated by the infamous group calling itself \u201cScattered Lapsus$ Hunters<\/a>,\u201d (a coalition that mixes the ways and branding of Scattered Spider, Lapsu$, and ShinyHunters) and it carries a daring declare that Salesforce, one of many largest SaaS and CRM suppliers on the earth, has been breached and shut to 1 billion information (989 million information) are up on the market.<\/p>\n

\n
\"Scattered<\/a>
The leak web site launched by Scattered LAPSUS$ Hunters (Picture credit score: Hackread.com)<\/figcaption><\/figure>\n<\/div>\n

The group says the assault occurred in mid-2024 and that the stolen knowledge quantities to a number of terabytes. In messages posted to their web site, they allege the info consists of extremely delicate private info akin to Social Safety numbers, driver\u2019s licenses, and dates of delivery. They’re now demanding that Salesforce negotiate earlier than an October 10, 2025, deadline, warning that failure to take action will end result within the launch of the total cache.<\/p>\n

Moreover, the hackers are additionally inviting legislation companies to cooperate with them, even naming Berger Montague as a associate they’d share proof with. The hackers are presenting this much less like a risk and extra like a proposal. In addition they declare they’ll present detailed documentation to courts and regulators in america and Europe, alleging Salesforce acted with \u201cprison negligence\u201d by failing to dam repeated intrusions.<\/p>\n

The record of firms named as victims on the leak web site is huge. The group has listed 39 organizations whose knowledge they are saying was taken from Salesforce-hosted programs<\/a>. The record consists of:<\/p>\n

\n
\"Scattered<\/a>
(Picture credit score: Hackread.com)<\/figcaption><\/figure>\n<\/div>\n
    \n
  1. KFC \u2013 1.3GB<\/li>\n
  2. ASICS \u2013 9GB<\/li>\n
  3. UPS \u2013 91.34GB<\/li>\n
  4. IKEA \u2013 13GB<\/li>\n
  5. GAP, INC. \u2013 1GB<\/li>\n
  6. Petco \u2013 9.9GB<\/li>\n
  7. Cisco \u2013 5.6GB<\/li>\n
  8. McDonald\u2019s \u2013 28GB<\/li>\n
  9. Cartier \u2013 1.4GB<\/li>\n
  10. Adidas \u2013 37GB<\/li>\n
  11. Fujifilm \u2013 155MB<\/li>\n
  12. Instacart \u2013 32GB<\/li>\n
  13. Marriott \u2013 7GB<\/li>\n
  14. Walgreens \u2013 11GB<\/li>\n
  15. Pandoranet \u2013 8.3GB<\/li>\n
  16. Chanel \u2013 2GB<\/li>\n
  17. CarMax \u2013 1.7GB<\/li>\n
  18. Disney\/Hulu \u2013 36GB<\/li>\n
  19. TransUnion \u2013 22GB<\/li>\n
  20. Aerom\u00e9xico \u2013 172.95GB<\/li>\n
  21. Toyota Motor Firms \u2013 64GB<\/li>\n
  22. Stellantis \u2013 59GB<\/li>\n
  23. Republic Companies \u2013 42GB<\/li>\n
  24. TripleA (aaacom) \u2013 23GB<\/li>\n
  25. Saks Fifth \u2013 1.1GB<\/li>\n
  26. Albertsons (Jewel Osco, and many others) \u2013 2GB<\/li>\n
  27. Engie Sources (Plymouth) \u2013 3GB<\/li>\n
  28. 1-800Accountant \u2013 18GB<\/li>\n
  29. HMH (hmhcocom) \u2013 88GB<\/li>\n
  30. Instructurecom \u2013 Canvas \u2013 35GB<\/li>\n
  31. Google Adsense \u2013 19GB<\/li>\n
  32. HBO Max \u2013 3.2GB<\/li>\n
  33. FedEx \u2013 1.1TB<\/li>\n
  34. Qantas Airways \u2013 153GB<\/li>\n
  35. Vietnam Airways \u2013 63.62GB<\/li>\n
  36. Air France & KLM \u2013 51GB<\/li>\n
  37. House Depot \u2013 19.43GB<\/li>\n
  38. Kering (Gucci, Balenciaga, Brioni, AlexMcQ) \u2013 10GB<\/li>\n<\/ol>\n

    Hackers Accuse Salesforce of Failure<\/strong><\/h3>\n

    The hackers accuse Salesforce of failing to implement multi-factor authentication and say they efficiently focused greater than 100 extra unnamed situations by OAuth utility weaknesses. In addition they level to earlier warnings, claiming they emailed Salesforce in July 2025 from an handle linked to the operation and acquired no significant response.<\/p>\n

    The hackers current their message as half ransom demand, half technical briefing. They level out that their assaults ran for a 12 months, left clear traces, and argue Salesforce had sufficient time to identify and cease them<\/p>\n

    In addition they cite GDPR, CCPA, and HIPAA obligations, arguing that knowledge safety duties have been ignored. To again this up, they promise to launch forensic-style paperwork with assault fingerprints, affected populations damaged down by nation, and particulars concerning the varieties of knowledge uncovered.<\/p>\n

    The attackers present a tuta.io<\/code> primarily based contact handle and require any communication to incorporate a strict verification format within the topic line. They are saying verified representatives will then be forwarded to a dwell channel the place negotiations can happen.<\/p>\n

    Salesforce Apparently Is aware of<\/strong><\/h3>\n

    The hackers have additionally circulated a screenshot on their Telegram channel that seems to point out a Salesforce safety advisory acknowledging ongoing extortion makes an attempt. Within the message, Salesforce refers to social engineering threats, states that there isn’t a proof its platform was compromised, and reassures prospects that its groups are monitoring the state of affairs. <\/p>\n

    \n
    \"Scattered<\/a>
    Screenshot shared by the hackers exhibiting Salesforce advisory (Picture credit score: Hackread.com)<\/figcaption><\/figure>\n<\/div>\n

    Because the picture can’t be independently verified, it’s unclear whether or not this advisory is genuine or fabricated as a part of the attackers\u2019 marketing campaign. Nonetheless, the group\u2019s web site maintains the deadline of October 10, 2025, with the standing listed as \u201cEnergetic.\u201d And, with the location dwell, the group now has a public instrument to extend stress on the corporate because the deadline approaches.<\/p>\n

    \n\t\t\t<\/div>\n

    <\/script>
    \n
    <\/p>\n","protected":false},"excerpt":{"rendered":"

    A brand new leak web site has gone dwell, operated by the infamous group calling itself \u201cScattered Lapsus$ Hunters,\u201d (a coalition that mixes the ways and branding of Scattered Spider, Lapsu$, and ShinyHunters) and it carries a daring declare that Salesforce, one of many largest SaaS and CRM suppliers on the earth, has been breached […]<\/p>\n","protected":false},"author":2,"featured_media":7326,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[58],"tags":[641,5675,1018,5712,5711,5713,2561,2793,2075],"class_list":["post-7324","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","tag-breach","tag-claim","tag-firms","tag-hunters","tag-lapsus","tag-listed","tag-records","tag-salesforce","tag-scattered"],"_links":{"self":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/7324","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=7324"}],"version-history":[{"count":1,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/7324\/revisions"}],"predecessor-version":[{"id":7325,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/posts\/7324\/revisions\/7325"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=\/wp\/v2\/media\/7326"}],"wp:attachment":[{"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=7324"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=7324"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/techtrendfeed.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=7324"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}