Hackers Extorting Salesforce After Stealing Data From Dozens of Customers

A threat actor supposedly formed of members of known hacking groups has claimed the theft of large amounts of data from dozens of Salesforce customers.

Calling themselves Scattered LAPSUS$ Hunters, the miscreants appear to be members of the notorious Lapsus$, Scattered Spider, and ShinyHunters groups.

Lapsus$ has been inactive since 2022, when Scattered Spider emerged. ShinyHunters first appeared in 2020 and joined forces with Scattered Spider earlier this year. They jointly announced their retirement last month.

On a new Tor-based leak site, Scattered LAPSUS$ Hunters has listed 39 organizations targeted in their recent Salesforce campaign, claiming the theft of their data from Salesforce instances and threatening to leak it unless the CRM provider pays a ransom.

The list includes known brands such as Adidas, Air France/KLM, Allianz Life, Cisco, Dior, Disney, FedEx, Google, Home Depot, Kering, Louis Vuitton, Qantas, Stellantis, Toyota, TransUnion, UPS, and Workday.

The hackers, who claim ...