The newly formed cybercrime alliance, “Scattered LAPSUS$ Hunters,” has launched a new website detailing its claims of a massive data breach affecting Salesforce and its extensive customer base. This development is the latest move by the group, a notorious collaboration between members of the established threat actor crews ShinyHunters, Scattered Spider, and LAPSUS$. On their new site, the group is extorting Salesforce directly, threatening to leak nearly one billion records with a ransom deadline of October 10, 2025.
This situation stems from a widespread and coordinated campaign that targeted Salesforce customers throughout mid-2025. According to security researchers, the attacks did not exploit a vulnerability in Salesforce’s core platform. Instead, the threat actors, particularly those from the Scattered Spider group, employed sophisticated social engineering tactics.
The primary method involved voice phishing (vishing), where attackers impersonated corporate IT or help desk staff in phone calls to employees of target companies. These employees were then manipulated into authorizing malicious third-party applications within their company’s Salesforce environment. This action granted the attackers persistent access tokens (OAuth), allowing them to bypass multi-factor authentication and exfiltrate vast amounts of data. The alliance has now consolidated the data from these numerous breaches for this large-scale extortion attempt against Salesforce itself.
The website lists dozens of high-profile Salesforce customers allegedly compromised in the campaign. The list of alleged victims posted by the group includes:
- Toyota Motor Corporations (🇯🇵): A multinational automotive manufacturer.
- FedEx (🇺🇸): A global courier delivery services company.
- Disney/Hulu (🇺🇸): A multinational mass media and entertainment conglomerate.
- Republic Services (🇺🇸): An American waste disposal company.
- UPS (🇺🇸): A multinational shipping, receiving, and supply chain management company.
- Aeroméxico (🇲🇽): The flag carrier airline of Mexico.
- Home Depot (🇺🇸): The largest home improvement retailer in the United States.
- Marriott (🇺🇸): A multinational company that operates, franchises, and licenses lodging.
- Vietnam Airlines (🇻🇳): The flag carrier of Vietnam.
- Walgreens (🇺🇸): An American company that operates the second-largest pharmacy store chain in the United States.
- Stellantis (🇳🇱): A multinational automotive manufacturing corporation.
- McDonald’s (🇺🇸): A multinational fast food chain.
- KFC (🇺🇸): A fast food restaurant chain that specializes in fried chicken.
- ASICS (🇯🇵): A Japanese multinational corporation which produces sportswear.
- GAP, INC. (🇺🇸): A worldwide clothing and accessories retailer.
- HMH (hmhco.com) (🇺🇸): A publisher of textbooks, instructional technology materials, and assessments.
- Fujifilm (🇯🇵): A multinational photography and imaging company.
- Instructure.com – Canvas (🇺🇸): An educational technology company.
- Albertsons (Jewel Osco, etc) (🇺🇸): An American grocery company.
- Engie Resources (Plymouth) (🇺🇸): A retail electricity provider.
- Kering (🇫🇷): A global luxury group that manages brands like Gucci, Balenciaga, and Brioni.
- HBO Max (🇺🇸): A subscription video on-demand service.
- Instacart (🇺🇸): A grocery delivery and pick-up service.
- Petco (🇺🇸): An American pet retailer.
- Puma (🇩🇪): A German multinational corporation that designs and manufactures athletic footwear and apparel.
- Cartier (🇫🇷): A French luxury goods conglomerate.
- Adidas (🇩🇪): A multinational corporation that designs and manufactures shoes, clothing, and accessories.
- TripleA (aaa.com) (🇺🇸): A federation of motor clubs throughout North America.
- Qantas Airways (🇦🇺): The flag carrier of Australia.
- CarMax (🇺🇸): A used vehicle retailer.
- Saks Fifth (🇺🇸): An American luxury department store chain.
- 1-800Accountant (🇺🇸): A nationwide accounting firm.
- Air France & KLM (🇫🇷/🇳🇱): A major European airline partnership.
- Google Adsense (🇺🇸): A program run by Google through which website publishers serve advertisements.
- Cisco (🇺🇸): A multinational digital communications technology conglomerate.
- Pandora.net (🇩🇰): A Danish jewelry manufacturer and retailer.
- TransUnion (🇺🇸): An American consumer credit reporting agency.
- Chanel (🇫🇷): A French luxury fashion house.
- IKEA (🇸🇪): A Swedish-founded multinational group that designs and sells ready-to-assemble furniture.
According to the actor, the breach involves nearly 1 billion records from Salesforce and its clients. The allegedly compromised data includes:
- Sensitive Personally Identifiable Information (PII)
- Strategic business records that could impact market position
- Data from over 100 other demand instances hosted on Salesforce infrastructure
