A sprawling social engineering campaign tied to the Lapsus$/Scattered Spider/ShinyHunters ecosystem is extorting enterprises after allegedly siphoning close to a billion records from Salesforce customer environments. Attackers claim broad theft of personally identifiable information from organizations that use Salesforce, while the vendor states its core platform and code were not breached. Evidence points to identity-led social engineering, followed by misuse of sanctioned tools and APIs to quietly extract large data volumes. For telecom and enterprise IT, CRM data now sits on the front line of extortion economics, raising urgent questions about identity controls, SaaS hardening, and third-party risk.