Quick Takeaways
- Salesforce will not negotiate or pay ransom amid massive data theft, warning that stolen data may be leaked by threat actors.
- The threat actors, "Scattered Lapsus$ Hunters," are extorting nearly 1 billion data records from over 760 companies, including major brands like Google, Disney, and IKEA.
- Data was stolen through two campaigns in 2024-2025: social engineering attacks involving OAuth impersonation and the use of stolen tokens to exfiltrate sensitive data.
- The threat actors created a data leak site to extort companies, but it has now been shut down; the FBI’s involvement in domain seizure remains unconfirmed.
Problem Explained
In 2025, Salesforce faced a significant security crisis when threat actors from a hacking group called “ShinyHunters” orchestrated two separate campaigns to steal data from the company’s systems. The first campaign, which began at the end of 2024, involved manipulative social engineering tactics where attackers impersonated IT staff to trick employees into granting access to Salesforce databases, impacting major companies like Google, Cisco, and Adidas. The second campaign, starting in August 2025, exploited stolen OAuth tokens to infiltrate customer CRM environments, primarily targeting support ticket data containing sensitive credentials and tokens, leading to thefts involving numerous organizations including Cloudflare, CyberArk, and Palo Alto Networks. The hackers created a data leak website on breachforums[.]hn to extort nearly 39 companies, threatening to release over 1 billion stolen records unless ransom demands were met. Salesforce explicitly declared it would not negotiate or pay the ransom, citing credible intelligence suggesting the threat actors intended to leak the data publicly. Although the leak site has since been shut down and domain seizures are suspected, the breach underscores the persistent risks of social engineering and supply chain vulnerabilities, with the incident reported by cybersecurity outlets like BleepingComputer and reportedly under scrutiny by law enforcement agencies such as the FBI.
Risk Summary
The recent Salesforce data breaches exemplify the severe cyber risks faced by organizations today, involving sophisticated social engineering, OAuth token exploitation, and large-scale data exfiltration affecting hundreds of major corporations across various industries. Threat actors, like ShinyHunters, managed to steal nearly 1.5 billion data records from over 760 firms and threatened to publicly release this sensitive information through a maintained data leak site, emphasizing the growing menace of extortion and data theft. These incidents not only compromise individual company security but also threaten entire supply chains and customer trust, illustrating how cybercriminal operations now leverage advanced tactics and extensive data repositories to maximize impact and leverage. The refusal of Salesforce and others to negotiate or pay ransom underscores a critical shift toward resilience-focused cybersecurity strategies amid such high-profile attacks, highlighting the urgent need for robust defense measures, vigilant monitoring, and coordinated threat intelligence to mitigate the devastating consequences of these pervasive cyber threats.
Fix & Mitigation
Addressing the issue of Salesforce refusing to pay ransom amidst widespread data theft attacks is critical to safeguarding organizational integrity, preventing further breaches, and maintaining customer trust. Timely remediation not only minimizes financial and reputational damage but also helps prevent attackers from exploiting vulnerabilities repeatedly.
Mitigation Strategies
- Incident Containment: Immediately isolate affected systems to prevent the spread of the breach.
- Legal Consultation: Seek legal advice to understand obligations and potential liabilities.
- Notification Protocols: Inform affected stakeholders, including customers and regulators, according to compliance requirements.
- Threat Assessment: Conduct a thorough investigation to identify the scope and entry points of the attack.
- Data Recovery: Restore affected systems from secure backups to resume normal operations.
- Security Enhancement: Strengthen security controls, including patching known vulnerabilities, implementing multi-factor authentication, and updating passwords.
- Collaboration: Work with cybersecurity experts and law enforcement agencies for investigation and guidance.
- Employee Training: Educate staff on security best practices and recognizing phishing attempts.
- Monitoring & Alerts: Set up continuous monitoring for unusual activities to detect future threats early.
Stay Ahead in Cybersecurity
Explore career growth and education via Careers & Learning, or dive into Compliance essentials.
Understand foundational security frameworks via NIST CSF on Wikipedia.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
