Cybercrime
,
Fraud Management & Cybercrime
ShinyHunters May Have Struck Again
European airlines Air France and KLM are in the salvage phase of a data breach incident that has the hallmarks of the cybercrime group that calls itself ShinyHunters, which specializes in gaining access to Salesforce customers’ data.
See Also: Why Cyberattackers Love ‘Living Off the Land’
The airlines “detected unusual activity on an external platform we use for customer service,” they said in a Wednesday breach alert. “Our IT security teams, along with the relevant external party, took immediate action to stop the unauthorized access.”
The Air France-KLM Group, headquartered in Paris, operates a fleet comprised of 574 aircraft, and transported 98 million passengers to 320 destinations in 2024. It said hackers didn’t reach internal systems, nor stole “sensitive data such as passwords, travel details, Flying Blue miles, passport or credit card information.”
The airlines didn’t state which customer-service platform was breached. Salesforce touts the airlines as customers. Hackers of a loose aggregation of cybercriminals known as ShinyHunters are conducting a spate of social engineering attacks targeting Salesforce customers. Recent victims include technology giants Google and Cisco and Australian airline Quantas.
The Air France-KLM Group didn’t immediately respond to a request for comment about how many customers were affected by the breach or if it involved Salesforce.
The airlines haven’t detailed what information did get stolen. Recent breaches of organizations’ Salesforce data have resulted in the exposure of names and contact information, including email addresses.
“Customers whose data may have been accessed are currently being informed and advised to be extra vigilant for suspicious emails or phone calls,” the airlines said.
Attackers Trick Salesforce Users
Multiple organizations report being breached after attackers tricked customer support staff into giving access to their Salesforce CRM software instance through the social engineering tactic known as voice phishing.
Google has investigated the attacks, finding that hackers trick victim organizations into allowing them to connect a modified, unauthorized version of Salesforce’s Data Loader tool “to exfiltrate Salesforce data from victim organizations.” Google on Tuesday reported that in June, it too fell victim to Shiny Hunters, which it tracks as UNC6040 (see: Google and Cisco Report CRM Software Breaches Via Vishing).
Other organizations recently hit by ShinyHunters attacks against Salesforce instances include insurer Allianz Life, retailers Adidas and Victoria’s Secret, LVMH brands Dior, Louis Vuitton and Tiffany and potentially Danish jewelry company Pandora.
Luxury brand Chanel on Friday informed customers that on July 25, it learned of an attack that compromised a customer database being hosted by a third-party, Women’s Wear Daily first reported.
Salesforce has emphasized that these attacks don’t exploit any vulnerability in its infrastructure. “The Salesforce platform has not been compromised, and this issue is not due to any known vulnerability in our technology,” the company said Thursday. “As social engineering and phishing threats continue to rise, our top priority is to help customers strengthen their security posture.”
The company recommends customers follow multiple best practices to protect their data, including enabling multifactor authentication, maintaining least-privilege access and carefully monitoring which applications they allow to directly connect to any CRM instances.
ShinyHunters and Scattered Spider Crossover
Experts said ShinyHunters appears to be comprised largely of Western teenagers, who speak English natively and excel at social engineering, making them difficult to counter. The group sprang from a loose cybercrime community known as “The Com,” which also birthed groups such as Scattered Spider and has perpetrated numerous ransomware attacks (see: British Police Bust Four Scattered Spider Suspects in England).
To what extent individuals may cross over between operations carried out under either the ShinyHunters or Scattered Spider banner isn’t clear. Historically, ShinyHunters attacks appeared to focus on exfiltrating data and holding it to ransom, while Scattered Spider attacks appeared to focus on deploying ransomware and demanding a ransom, in addition to exfiltrating data. As a result, the nomenclature might not reflect a distinct group being at play, but rather a loose collective that selects whichever name best reflects the type of attack they’ve carried out.
A member of ShinyHunters, in a recent chat with the data breach blogger who runs the Databreaches.net site under the handle “Dissent Doe,” suggested there’s a high degree of crossover.
“ShinyHunters claims that as of yesterday, they now introduce their extortion emails with ‘Hello, we are ShinyHunters/Scattered Spider’ instead of ‘Hello, we are ShinyHunters,'” Dissent Doe said in a Wednesday post to LinkedIn.