Ransomware Group Debuts Salesforce Customer Data Leak Site

A notorious ransomware group launched Friday a data-leak site designed to pressure victims of a large Salesforce data breach into paying extortion money.

See Also: Preparing for the Next Attack

The Scattered Lapsus$ Hunters operation’s new darkweb data-leak site lists 39 victims, all of which integrated their Salesforce customer relationship management software with the Salesloft Drift artificial intelligence chatbot. Named victims include Cisco, Disney, KFC, Ikea, Marriott, McDonald’s, Walgreens, as well as grocery giant Albertsons and retailer Saks Fifth Avenue.

The group – ShinyHunters for short – claimed last month to have stolen 1.5 billion Salesforce records from 760 Salesloft Drift-using companies. Companies listed on the leak site account for the bulk of those records, according to ShinyHunters. On a dedicated Telegram channel, the group on Friday demanded a separate ransom from Salesforce not to leak data pertaining to the other 721 victims.

Samples of stolen data published include extensive personally identifiable information, including names, data of birth and nationality, passport numbers, full contact information and employment histories, cybersecurity researcher Milivoj Rajić said. He tested multiple samples of the leaked data and confirmed their validity.

Other data includes shipping information, marketing lead data, customer support case records, chat transcripts, flight details, car ownership records and more, Rajić told Information Security Media Group.

Salesforce said it’s aware of the extortion attempts and that it’s been probing them with the help of outside experts and agencies. “Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support,” spokesman Allen Tsai told ISMG. “At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology.”*

Cybersecurity experts say Scattered Spider, Lapsus$ and ShinyHunters all emerged in recent years from the English-speaking cybercrime community calling itself “The Com.” This loosely organized network operates more as a cybercrime youth movement, encompassing a broad and constantly shifting range of actors – mainly teens and twentysomethings, said threat intelligence firm Resecurity in a recent report.

“All three groups are renowned for their advanced social engineering capabilities, including vishing – voice phishing, phishing, and impersonation of IT staff to trick employees into granting them access or installing malware,” Resecurity said.

Their attacks have continued despite law enforcement continuing to arrest accused members of the collective.

Attackers First Hit Salesloft Drift

The FBI on Sept. 12 warned that the attackers employed stolen OAuth tokens used to integrate the Salesloft Drift Email’s AI chatbot with Salesforce instances. Google’s threat intelligence group previously reported that the attacks started as early as Aug. 8 and ran until Aug. 18, and that approximately 700 Salesloft customers fell victim.

ShinyHunters claimed to Bleeping Computer that it first hacked into Salesloft’s GitHub repository and gained access to its private source code. After scanning the code, the attackers said they recovered OAuth tokens, including for 760 Salesloft-using Salesforce customers.

Cybersecurity experts said the attackers also stole OAuth tokens providing access to other cloud resources, including Google Workspace.

ShinyHunters has been targeting Salesforce data using a variety of tactics, tracked by security researchers as a threat cluster codenamed UNC6040.

“UNC6040 threat actors commonly call victims’ call centers posing as IT support employees addressing enterprise-wide connectivity issues,” the FBI said in its advisory. “Under the guise of closing an auto-generated ticket, UNC6040 actors trick customer support employees into taking actions that grant the attackers access or lead to the sharing of employee credentials, allowing them access to targeted companies’ Salesforce instances to exfiltrate customer data.”

Google said that after gaining access to a victim’s network, in many cases, UNC6040 moves laterally and also attempts to exfiltrate data being stored in a victim’s Microsoft 365 and Okta platforms.

To help organizations better repel these attacks, Google’s Mandiant incident response group, working with Salesforce, on Tuesday published a structured defensive framework encompassing proactive hardening measures, comprehensive logging protocols and advanced detection capabilities.

ShinyHunters said it also stole OAuth tokens from Salesloft that gave it access to other applications they integrated with Drift. “We also dumped over 100+ other unnamed instances because you do not enforce 2FA or any other type of OAuth Apps security,” the attackers claimed.

Repeat Target: Third-Party Software

The data-exfiltration attacks against Salesforce customers aren’t the only supply-chain attacks that have lately resulted in the mass theft of data.

Organizations that use Oracle E-Business Suite are also under fire, with attackers appearing to have stolen data from potentially hundreds of organizations that hadn’t installed Oracle security updates released in July (see: Oracle Sees No Zero-Day Exploits Tied to Customer Extortion).

Widely used software is a high-profile target for criminals who want to attempt to steal data from many different organizations at once. Although useful, at the same time, “third-party software is dangerous for companies because it can introduce security vulnerabilities that attackers exploit – often beyond the company’s control,” Rajić said.

The attacks are a reminder that customers “should conduct thorough security assessments and regular audits of their third-party vendors,” ensure that they’re collectively all using “strong access controls,” as well as verify that vendors are carefully monitoring and patching their wares.

When all else fails, “to help mitigate potential damage,” Rajić recommends customers have at the ready a well-practiced, third-party supplier breach incident response plan.

*Update Oct. 3, 2025 18:34 UTC: Adds comment from Salesforce.