Executive summary of the Salesforce breach claims
A sprawling social engineering campaign tied to the Lapsus$/Scattered Spider/ShinyHunters ecosystem is extorting enterprises after allegedly siphoning close to a billion records from Salesforce customer environments.
Key findings and security implications
Attackers claim broad theft of personally identifiable information from organizations that use Salesforce, while the vendor states its core platform and code were not breached.
The operation leans on voice phishing of IT help desks, session takeover, and abuse of legitimate data export tools and APIs rather than classic ransomware encryption.
Victims span multiple sectors and geographies, including insurers, airlines, automakers, retail, credit bureaus, and tech platforms, pointing to a systemic SaaS supply-chain exposure.
For telecom and enterprise IT, CRM data now sits on the front line of extortion economics, raising urgent questions about identity controls, SaaS hardening, and third-party risk.
What the attackers claim and how they’re extorting
A new dark web leak site branded “Scattered LAPSUS$ Hunters” is pressuring enterprises to pay or face public dumps of data allegedly pulled from Salesforce-hosted customer databases.
Threat actors and extortion tactics
The crew aligns with past personas known as Lapsus$, Scattered Spider, and ShinyHunters, groups linked to high-impact social engineering and data theft. The leak site lists dozens of organizations and urges targets to negotiate to avoid disclosure. The tone suggests a pivot to pure extortion, where publication—not encryption—is the leverage.
Affected organizations and verification status
Companies acknowledging theft tied to recent activity include Allianz Life, Google, Kering, Qantas, Stellantis, TransUnion, and Workday, with others such as FedEx, Hulu, and Toyota cited by the site. The group has also claimed prior breaches at Marks & Spencer, Co-op, and Jaguar Land Rover. The “nearly one billion records” figure remains unverified. Salesforce says it sees no evidence of a platform compromise or vulnerability, indicating attackers targeted customers rather than the vendor’s infrastructure.
Why this hits telecom and enterprise IT now
Cloud CRM has become a high-value target as attackers chase aggregated PII, contracts, and service data that convert quickly into extortion leverage.
Why cloud CRM is a prime target
For operators and technology providers, Salesforce often houses subscriber PII, enterprise account hierarchies, deal pipelines, service orders, field service schedules, partner agreements, and support history. A breach risks fraud, SIM swap enablement, account takeover, and exposure of sensitive B2B negotiations, impacting churn, SLAs, and revenue assurance.
Data-theft extortion, not encryption
Data theft and publication pressure compress incident-response timelines. Even partial exposure can trigger regulatory reporting, customer notifications, and competitive harm. This model also spreads quickly across subsidiaries and partners connected via shared CRM and integrations.
How the attackers gained access and exfiltrated data
Evidence points to identity-led social engineering, followed by misuse of sanctioned tools and APIs to quietly extract large data volumes.
Vishing-led help desk bypass and MFA resets
Attackers reportedly impersonate employees over the phone to service desks to reset MFA or issue new devices. Once they capture a session or credentials, they pivot into SaaS with legitimate access, which complicates detection because activity blends with normal workflows.
Abuse of Data Loader, Bulk API, and connected apps
Security researchers have documented this actor coaxing users into installing tampered versions of Salesforce’s Data Loader and exploiting Bulk API and export functions. With valid accounts and tokens, exfiltration can occur over approved channels, evading perimeter controls. OAuth-connected apps, report exports, and API batch jobs become the exfil path.
Actor ecosystem and tracking
Threat intel teams, including Google’s, track related activity as UNC6040 and note overlaps with a looser criminal ecosystem dubbed “The Com.” Age and role diversity within these networks complicate arrests and takedowns, and splinter groups often continue operations.
Business, privacy, and regulatory impact
The data types in play pull in privacy, financial, and sector regulations with significant penalties and remediation costs.
Privacy, sector, and audit obligations
Enterprises face GDPR and CCPA reporting clocks, PCI DSS implications if payment data intersects CRM, and telecom-specific obligations tied to customer proprietary network information. Audit and assurance frameworks such as SOC 2 and ISO 27001 may also be impacted, with downstream effects on customer contracts and cyber insurance claims.
Third-party access and SaaS supply-chain risk
Partners, BPO call centers, contractors, and MSPs often hold help desk duties or CRM access. A weak link in identity proofing or device posture at a service provider can expose a primary operator’s data. Single sign-on, directory sync, and integration users create lateral pathways if not constrained.
Immediate CISO actions and controls
Treat this as an active SaaS data-theft campaign and assume valid-credential misuse until proven otherwise.
Urgent triage and containment steps
Audit Salesforce Event Monitoring for spikes in Bulk API calls, report exports, login anomalies, and connected app activity. Revoke suspicious OAuth tokens and sessions, rotate integration credentials, and disable unused or high-risk connected apps. Suspend accounts with anomalous access and quarantine endpoints associated with unusual Data Loader activity.
Hardening identity and Salesforce configurations
Enforce SSO with conditional access and device posture for Salesforce, require high-assurance re-authentication for data export, and restrict Data Loader and Bulk API to approved IP ranges and managed devices. Implement Transaction Security Policies or equivalent to block or require approval for large exports. Apply least privilege on profiles and permission sets for report creation, data export, and API usage. Disable legacy authentication methods, tighten session timeouts, and use IP allowlists for admin tasks.
Adopt Salesforce Shield Event Monitoring for deeper telemetry, and map detections to common techniques such as voice phishing and valid account misuse. Validate the integrity and distribution channel of administrative tools, and block installation of unapproved binaries via endpoint controls.
Help desk and contractor process controls
Harden help desk scripts for identity verification, enforce no-reset rules without out-of-band checks, and require supervisor approval for MFA resets and new device enrollments. Run vishing simulations targeting service desks and call centers. Tighten contractor and BPO controls with dedicated SSO tenants, stricter scopes, and continuous monitoring.
Detection engineering and response playbooks
Integrate Salesforce logs with SIEM and UEBA to baseline API usage by user and profile. Deploy CASB or SSPM to monitor configuration drift and risky connected apps. Add DLP policies for CRM exports to cloud storage and email. Seed CRM with honeytokens to detect data abuse downstream. Prepare legal and communications playbooks for data extortion, coordinate with law enforcement, and avoid direct engagement without counsel.
What to monitor next
Expect rapid iterations by adversaries and evolving guidance from vendors and regulators.
Leak cadence and copycat operations
Track whether the site begins timed dumps to escalate pressure and whether other groups imitate the model against additional SaaS platforms beyond CRM. Monitor for rebranding if takedowns occur.
Vendor advisories and control updates
Look for Salesforce advisories on export controls, connected app governance, and hardened defaults for Data Loader and Bulk API. Expect new detections and playbooks from threat intel teams and potential alerts from national cyber agencies.
Legal actions, fines, and industry guidance updates
Law enforcement actions, including recent arrests tied to UK retail incidents, may fragment the group but rarely end operations. Watch for GDPR fines, class actions, and updates to telecom-specific guidance on safeguarding customer data within SaaS ecosystems.
