{"id":128924,"date":"2025-10-03T16:17:30","date_gmt":"2025-10-03T16:17:30","guid":{"rendered":"https:\/\/cybersecuritynews.com\/?p=128924"},"modified":"2025-10-07T11:02:38","modified_gmt":"2025-10-07T11:02:38","slug":"scattered-lapsus-hunters-salesforce","status":"publish","type":"post","link":"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/","title":{"rendered":"Scattered LAPSUS$ Hunters Announced Salesforce Breach List On New Onion Site"},"content":{"rendered":"\n

A cybercrime collective known as Scattered LAPSUS$<\/a> Hunters has launched a new data leak site on the dark web, claiming it holds nearly one billion records from Salesforce customers.<\/p>\n\n\n\n

The group is orchestrating a widespread blackmail campaign, setting a ransom deadline of October 10, 2025. They have threatened to publish sensitive data and technical details if their demands are not met.<\/p>\n\n\n\n

The threat actors allege that significant security lapses at Salesforce, including inadequate two-factor authentication (2FA) and OAuth protections, enabled them to compromise over 100 Salesforce instances. <\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Their new onion site lists numerous high-profile companies as victims of the data theft, including Toyota Motor Corporation, FedEx, UPS, Adidas, Disney\/Hulu, and McDonald’s. <\/p>\n\n\n\n

\"\"\/<\/figure>\n\n\n\n

Other prominent names listed are Qantas, Aerom\u00e9xico, Vietnam Airlines, Stellantis, IKEA, KFC, GAP, and the educational platform Canvas by Instructure.<\/p>\n\n\n\n

Scattered LAPSUS$ Hunte<\/strong>rs Listings<\/strong><\/h2>\n\n\n\n

Scattered LAPSUS$ Hunters is not a new entity but rather a coalition of members from some of the most infamous hacking groups, including ShinyHunters, Scattered Spider<\/a>, and Lapsus$.<\/p>\n\n\n\n

This alliance has been linked to a series of major cyberattacks throughout 2025, with a particular focus on Salesforce environments. The group’s formation represents a “trinity of chaos,” combining different skill sets to execute complex intrusion campaigns.<\/p>\n\n\n\n

A blend of sophisticated social engineering and technical exploitation characterizes their methods. Attackers have been observed using voice phishing (vishing)<\/a> campaigns, where they impersonate IT support staff in phone calls to trick employees.<\/p>\n\n\n\n

During these calls, victims are guided to authorize a malicious application, which captures OAuth tokens<\/a>. These tokens grant the attackers persistent access to the company’s Salesforce environment, effectively bypassing multi-factor authentication controls and allowing for the mass exfiltration of CRM data.<\/p>\n\n\n\n

The Salesforce campaign highlights a strategic evolution in cybercrime tactics. Instead of relying on traditional ransomware that encrypts files, groups like Scattered LAPSUS$ Hunters are focusing on data theft and extortion.<\/p>\n\n\n\n

The leverage is not the disruption of systems but the public exposure of stolen data, which can lead to customer backlash, regulatory fines, and severe reputational damage.<\/a><\/p>\n\n\n\n

In mid-2025, actors associated with this collective claimed to have stolen 1.5 billion Salesforce records from 760 companies by compromising OAuth tokens linked to third-party integrations like Salesloft and Drift<\/a>.<\/p>\n\n\n\n

The attackers often release fragments of the stolen data as proof, holding back the full dataset to maximize pressure during negotiations. <\/p>\n\n\n\n

This incident follows a pattern seen in earlier 2025 attacks on companies like Google, Jaguar Land Rover<\/a>, and LVMH, where the same collective claimed responsibility.<\/p>\n\n\n\n

Despite a recent “farewell letter” announcing their distribution, security experts believe the group has simply rebranded, and the threat of large-scale data leaks remains significant.<\/p>\n\n\n\n

Cyber Awareness Month Offer: Upskill With 100+ Premium Cybersecurity Courses From EHA's Diamond Membership: Join Today<\/a><\/code><\/strong><\/strong><\/p>\n\n\n\n

<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

A cybercrime collective known as Scattered LAPSUS$ Hunters has launched a new data leak site on the dark web, claiming it holds nearly one billion records from Salesforce customers. The group is orchestrating a widespread blackmail campaign, setting a ransom deadline of October 10, 2025. They have threatened to publish sensitive data and technical details […]<\/p>\n","protected":false},"author":25,"featured_media":128929,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi4LQ09PbyOKb_-W5B1WerqMa7-X1LBG9f3bY8OhYYT2sAbhv8aiYAXbBE92HSR5TcMB08Y74ObxB9ZPI05Cb3p792M1khnSPBMhRFSvejeibts7Cg77vFOhtnNz68MNkLoQ2EnfbcO4HnRbIYTrShyhEpKc2oOQ4WYpYB08iV9KdtZdV4ryJnfWc_yETfj\/s1600\/1000041541.webp","fifu_image_alt":"Scattered LAPSUS$ Hunters Salesforce","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[11,3185],"tags":[149,151],"class_list":{"0":"post-128924","1":"post","2":"type-post","3":"status-publish","4":"format-standard","5":"has-post-thumbnail","7":"category-cyber-security-news","8":"category-data-breach","9":"tag-cyber-security","10":"tag-cyber-security-news"},"yoast_head":"\nScattered LAPSUS$ Hunters Announce Salesforce Breach List On New Onion Site<\/title>\n<meta name=\"description\" content=\"A cybercrime collective known as Scattered LAPSUS$ Hunters has launched a new data leak site on the dark web, claiming it holds nearly one billion records from Salesforce customers.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Scattered LAPSUS$ Hunters Announced Salesforce Breach List On New Onion Site\" \/>\n<meta property=\"og:description\" content=\"A cybercrime collective known as Scattered LAPSUS$ Hunters has launched a new data leak site on the dark web, claiming it holds nearly one billion records from Salesforce customers.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/\" \/>\n<meta property=\"og:site_name\" content=\"Cyber Security News\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/Hackingtutorialsandnews\" \/>\n<meta property=\"article:published_time\" content=\"2025-10-03T16:17:30+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2025-10-07T11:02:38+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi4LQ09PbyOKb_-W5B1WerqMa7-X1LBG9f3bY8OhYYT2sAbhv8aiYAXbBE92HSR5TcMB08Y74ObxB9ZPI05Cb3p792M1khnSPBMhRFSvejeibts7Cg77vFOhtnNz68MNkLoQ2EnfbcO4HnRbIYTrShyhEpKc2oOQ4WYpYB08iV9KdtZdV4ryJnfWc_yETfj\/s1600\/1000041541.webp\" \/><meta property=\"og:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi4LQ09PbyOKb_-W5B1WerqMa7-X1LBG9f3bY8OhYYT2sAbhv8aiYAXbBE92HSR5TcMB08Y74ObxB9ZPI05Cb3p792M1khnSPBMhRFSvejeibts7Cg77vFOhtnNz68MNkLoQ2EnfbcO4HnRbIYTrShyhEpKc2oOQ4WYpYB08iV9KdtZdV4ryJnfWc_yETfj\/s1600\/1000041541.webp\" \/>\n\t<meta property=\"og:image:width\" content=\"1600\" \/>\n\t<meta property=\"og:image:height\" content=\"900\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Cyber Advisory\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi4LQ09PbyOKb_-W5B1WerqMa7-X1LBG9f3bY8OhYYT2sAbhv8aiYAXbBE92HSR5TcMB08Y74ObxB9ZPI05Cb3p792M1khnSPBMhRFSvejeibts7Cg77vFOhtnNz68MNkLoQ2EnfbcO4HnRbIYTrShyhEpKc2oOQ4WYpYB08iV9KdtZdV4ryJnfWc_yETfj\/s1600\/1000041541.webp\" \/>\n<meta name=\"twitter:creator\" content=\"@The_Cyber_News\" \/>\n<meta name=\"twitter:site\" content=\"@The_Cyber_News\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Cyber Advisory\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Scattered LAPSUS$ Hunters Announce Salesforce Breach List On New Onion Site","description":"A cybercrime collective known as Scattered LAPSUS$ Hunters has launched a new data leak site on the dark web, claiming it holds nearly one billion records from Salesforce customers.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/","og_locale":"en_US","og_type":"article","og_title":"Scattered LAPSUS$ Hunters Announced Salesforce Breach List On New Onion Site","og_description":"A cybercrime collective known as Scattered LAPSUS$ Hunters has launched a new data leak site on the dark web, claiming it holds nearly one billion records from Salesforce customers.","og_url":"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/","og_site_name":"Cyber Security News","article_publisher":"https:\/\/www.facebook.com\/Hackingtutorialsandnews","article_published_time":"2025-10-03T16:17:30+00:00","article_modified_time":"2025-10-07T11:02:38+00:00","og_image":[{"url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi4LQ09PbyOKb_-W5B1WerqMa7-X1LBG9f3bY8OhYYT2sAbhv8aiYAXbBE92HSR5TcMB08Y74ObxB9ZPI05Cb3p792M1khnSPBMhRFSvejeibts7Cg77vFOhtnNz68MNkLoQ2EnfbcO4HnRbIYTrShyhEpKc2oOQ4WYpYB08iV9KdtZdV4ryJnfWc_yETfj\/s1600\/1000041541.webp","type":"","width":"","height":""},{"width":1600,"height":900,"url":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi4LQ09PbyOKb_-W5B1WerqMa7-X1LBG9f3bY8OhYYT2sAbhv8aiYAXbBE92HSR5TcMB08Y74ObxB9ZPI05Cb3p792M1khnSPBMhRFSvejeibts7Cg77vFOhtnNz68MNkLoQ2EnfbcO4HnRbIYTrShyhEpKc2oOQ4WYpYB08iV9KdtZdV4ryJnfWc_yETfj\/s1600\/1000041541.webp","type":"image\/jpeg"}],"author":"Cyber Advisory","twitter_card":"summary_large_image","twitter_image":"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi4LQ09PbyOKb_-W5B1WerqMa7-X1LBG9f3bY8OhYYT2sAbhv8aiYAXbBE92HSR5TcMB08Y74ObxB9ZPI05Cb3p792M1khnSPBMhRFSvejeibts7Cg77vFOhtnNz68MNkLoQ2EnfbcO4HnRbIYTrShyhEpKc2oOQ4WYpYB08iV9KdtZdV4ryJnfWc_yETfj\/s1600\/1000041541.webp","twitter_creator":"@The_Cyber_News","twitter_site":"@The_Cyber_News","twitter_misc":{"Written by":"Cyber Advisory","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"NewsArticle","@id":"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/#article","isPartOf":{"@id":"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/"},"author":{"name":"Cyber Advisory","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/1f05494981f36f0a408b14a80886065b"},"headline":"Scattered LAPSUS$ Hunters Announced Salesforce Breach List On New Onion Site","datePublished":"2025-10-03T16:17:30+00:00","dateModified":"2025-10-07T11:02:38+00:00","mainEntityOfPage":{"@id":"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/"},"wordCount":442,"publisher":{"@id":"https:\/\/cybersecuritynews.com\/#organization"},"image":{"@id":"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi4LQ09PbyOKb_-W5B1WerqMa7-X1LBG9f3bY8OhYYT2sAbhv8aiYAXbBE92HSR5TcMB08Y74ObxB9ZPI05Cb3p792M1khnSPBMhRFSvejeibts7Cg77vFOhtnNz68MNkLoQ2EnfbcO4HnRbIYTrShyhEpKc2oOQ4WYpYB08iV9KdtZdV4ryJnfWc_yETfj\/s1600\/1000041541.webp?w=1600&resize=1600,900&ssl=1","keywords":["cyber security","cyber security news"],"articleSection":["Cyber Security News","Data Breach"],"inLanguage":"en-US","copyrightYear":"2025","copyrightHolder":{"@id":"https:\/\/cybersecuritynews.com\/#organization"}},{"@type":"WebPage","@id":"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/","url":"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/","name":"Scattered LAPSUS$ Hunters Announce Salesforce Breach List On New Onion Site","isPartOf":{"@id":"https:\/\/cybersecuritynews.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/#primaryimage"},"image":{"@id":"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/#primaryimage"},"thumbnailUrl":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi4LQ09PbyOKb_-W5B1WerqMa7-X1LBG9f3bY8OhYYT2sAbhv8aiYAXbBE92HSR5TcMB08Y74ObxB9ZPI05Cb3p792M1khnSPBMhRFSvejeibts7Cg77vFOhtnNz68MNkLoQ2EnfbcO4HnRbIYTrShyhEpKc2oOQ4WYpYB08iV9KdtZdV4ryJnfWc_yETfj\/s1600\/1000041541.webp?w=1600&resize=1600,900&ssl=1","datePublished":"2025-10-03T16:17:30+00:00","dateModified":"2025-10-07T11:02:38+00:00","description":"A cybercrime collective known as Scattered LAPSUS$ Hunters has launched a new data leak site on the dark web, claiming it holds nearly one billion records from Salesforce customers.","breadcrumb":{"@id":"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/#primaryimage","url":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi4LQ09PbyOKb_-W5B1WerqMa7-X1LBG9f3bY8OhYYT2sAbhv8aiYAXbBE92HSR5TcMB08Y74ObxB9ZPI05Cb3p792M1khnSPBMhRFSvejeibts7Cg77vFOhtnNz68MNkLoQ2EnfbcO4HnRbIYTrShyhEpKc2oOQ4WYpYB08iV9KdtZdV4ryJnfWc_yETfj\/s1600\/1000041541.webp?w=1600&resize=1600,900&ssl=1","contentUrl":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi4LQ09PbyOKb_-W5B1WerqMa7-X1LBG9f3bY8OhYYT2sAbhv8aiYAXbBE92HSR5TcMB08Y74ObxB9ZPI05Cb3p792M1khnSPBMhRFSvejeibts7Cg77vFOhtnNz68MNkLoQ2EnfbcO4HnRbIYTrShyhEpKc2oOQ4WYpYB08iV9KdtZdV4ryJnfWc_yETfj\/s1600\/1000041541.webp?w=1600&resize=1600,900&ssl=1","width":"1600","height":"900","caption":"Scattered LAPSUS$ Hunters Salesforce"},{"@type":"BreadcrumbList","@id":"https:\/\/cybersecuritynews.com\/scattered-lapsus-hunters-salesforce\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/cybersecuritynews.com\/"},{"@type":"ListItem","position":2,"name":"Scattered LAPSUS$ Hunters Announced Salesforce Breach List On New Onion Site"}]},{"@type":"WebSite","@id":"https:\/\/cybersecuritynews.com\/#website","url":"https:\/\/cybersecuritynews.com\/","name":"Cyber Security News","description":"World's #1 Premier Cybersecurity and Hacking News Portal","publisher":{"@id":"https:\/\/cybersecuritynews.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/cybersecuritynews.com\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/cybersecuritynews.com\/#organization","name":"Cyber Security News","url":"https:\/\/cybersecuritynews.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/logo\/image\/","url":"https:\/\/cybersecuritynews.com\/wp-content\/uploads\/2021\/06\/Cyber-security.jpg","contentUrl":"https:\/\/cybersecuritynews.com\/wp-content\/uploads\/2021\/06\/Cyber-security.jpg","width":200,"height":200,"caption":"Cyber Security News"},"image":{"@id":"https:\/\/cybersecuritynews.com\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/Hackingtutorialsandnews","https:\/\/x.com\/The_Cyber_News","https:\/\/www.linkedin.com\/company\/cybersecurity-news\/"]},{"@type":"Person","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/1f05494981f36f0a408b14a80886065b","name":"Cyber Advisory","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/cybersecuritynews.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/a8b8f09401b343e59424683345cba3e47e7bdfb9b1c30a2d2868ef526034da1e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/a8b8f09401b343e59424683345cba3e47e7bdfb9b1c30a2d2868ef526034da1e?s=96&d=mm&r=g","caption":"Cyber Advisory"},"description":"CISO Advisory is a Team of Security Experts Covering Various Cybersecurity Research and Technical Write-ups.","sameAs":["https:\/\/www.cybersecuritynews.com"],"honorificPrefix":"Ms","gender":"Female","url":"https:\/\/cybersecuritynews.com\/author\/varshini\/"}]}},"jetpack_featured_media_url":"https:\/\/i0.wp.com\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi4LQ09PbyOKb_-W5B1WerqMa7-X1LBG9f3bY8OhYYT2sAbhv8aiYAXbBE92HSR5TcMB08Y74ObxB9ZPI05Cb3p792M1khnSPBMhRFSvejeibts7Cg77vFOhtnNz68MNkLoQ2EnfbcO4HnRbIYTrShyhEpKc2oOQ4WYpYB08iV9KdtZdV4ryJnfWc_yETfj\/s1600\/1000041541.webp?w=1600&resize=1600,900&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/128924","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/users\/25"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/comments?post=128924"}],"version-history":[{"count":4,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/128924\/revisions"}],"predecessor-version":[{"id":129200,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/posts\/128924\/revisions\/129200"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/media\/128929"}],"wp:attachment":[{"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/media?parent=128924"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/categories?post=128924"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecuritynews.com\/wp-json\/wp\/v2\/tags?post=128924"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}