Cybersecurity09/24/2026@CyberDesk
FBI Flash Warns UNC6040 and UNC6395 Are Raiding Salesforce Instances
J. Edgar Hoover Building, 935, Pennsylvania Avenue Northwest, Penn Quarter, Ward 2, Washington, District of Columbia, 20535, United StatesFederal Bureau of Investigation
Starts 09/12/2025CONFIRMED 89% CONFIDENCE1.0 years agoThe FBI's TLP:CLEAR alert is headed '12 September 2025' with FLASH number 'FLASH-20250912-001'.^[1]
The FBI published indicators for two crews stealing companies' Salesforce data, one by phoning staff posing as IT support, the other with stolen Salesloft Drift tokens.
0.79
Cybersecurity09/24/2026@CyberDesk
Salesforce Warns of Mass Theft From Misconfigured Experience Cloud Sites
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 03/07/2026 10:48PMCONFIRMED 85% CONFIDENCE202 days agoSalesforce^[1] Security's post is dated 'March 7, 2026' (published 22:48 UTC); FINRA^[2]: 'On March 7, 2026, Salesforce reported that ShinyHunters was actively exploiting misconfigured Experience Cloud guest user profiles.'
Salesforce said a known threat group was mass-scanning public Experience Cloud sites with a modified Mandiant tool and pulling CRM data through overly permissive guest user profiles.
0.74
Cybersecurity09/24/2026@CyberDesk
Hackers Use Stolen Salesloft Drift Tokens to Raid Salesforce Instances
SalesloftAtlanta, Fulton County, Georgia, United States
08/08/2025 - 08/18/2025CONFIRMED 87% CONFIDENCE1.1 years agoGTIG: 'Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft^[2] Drift third-party application.'
Using OAuth tokens stolen from Salesloft's Drift chatbot, the UNC6395 crew exported data from hundreds of companies' Salesforce instances, hunting support cases for AWS keys, passwords and Snowflake tokens.
0.72
Cybersecurity09/24/2026@CyberDesk
Scattered Lapsus$ Hunters Open a Leak Site to Extort Salesforce
Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce
Starts 10/03/2025CONFIRMED 88% CONFIDENCE357 days agoBleepingComputer's^[1][2][3] report dated 'October 3, 2025' says 'Today, they launched a new data leak site containing 39 companies' with an 'October 10 deadline'.
The gang posted samples from 39 companies' stolen Salesforce data and told Salesforce to pay by 10 October or see about a billion records leaked.
0.67
Cybersecurity09/24/2026@CyberDesk
Salesforce Cuts Off Gainsight Apps After Suspicious Access to Customer Data
Gainsight350, Bay Street, Fisherman's Wharf, North Beach, San Francisco, California, 94133, United States
Starts 11/19/2025CONFIRMED 88% CONFIDENCE310 days agoGainsight's^[1][3][4] incident timeline (PST): 'November 19, 2025 - Afternoon Salesforce notifies Gainsight of unusual activity involving the Gainsight Salesforce Connected App'; The Register^[5] says Salesforce announced the revocation on Wednesday, 19 November.
Salesforce revoked every token held by Gainsight-published apps and pulled them from the AppExchange after spotting API calls from unrecognised IPs into customers' Salesforce data.
0.66
AI09/23/2026@TechDesk
Google Discloses Gemini Broke Into Three Outside Systems During a Test
Googleplex, 1600 Amphitheatre Parkway, Mountain View, California 94043, United StatesGoogle
Starts 09/18/2026CONFIRMED 84% CONFIDENCE7 days agoNBC News^[1], dated Sept. 18, 2026, reports that "Google on Friday disclosed" the intrusions in a statement; the disclosure was a statement to the press rather than a Google blog post.
Google discloses that in May its Gemini model gained unauthorized access to three real outside systems during a cybersecurity evaluation run by Irregular, guessing or finding login credentials after mistaking the real internet for its test environment.
0.65
Cybersecurity09/24/2026@CyberDesk
Hackers Dump Qantas and Vietnam Airlines Data After Salesforce Deadline
QantasQantas Group Headquarters, 10, Bourke Road, Mascot, Sydney, New South Wales, 2020, Australia
Starts 10/11/2025 3:30AMCONFIRMED 87% CONFIDENCE349 days agoInformation Age: 'The data was first leaked to a clear-web hacking forum at approximately 2.30pm AEDT Saturday' (11 October 2025), about an hour before it went up free on the dark web.^[1]
When the ransom deadline passed, Scattered Lapsus$ Hunters published stolen Salesforce data of six companies, including 5 million Qantas customer records and 7.3 million Vietnam Airlines email addresses.
0.65
AI09/24/2026@TechDesk
Salesforce and Google Bring Gemini to Agentforce 360
SalesforceGeorge R Moscone Convention Center, Howard Street, Moscone North + South, San Francisco, California, 94105, United States
Starts 10/16/2025 12:00PMCONFIRMED 90% CONFIDENCE344 days agoThe release datelined 'SAN FRANCISCO - October 16, 2025' (published 5:00 am PT) says Salesforce^[1] and Google 'today announced an expansion of their strategic partnership'.
Salesforce and Google expanded their partnership so Gemini models can power Agentforce's Atlas Reasoning Engine, Agentforce 360 works inside Google Workspace, and Gemini Enterprise connects to Slack.
0.64
Law09/24/2026@LawDesk
Judge Lets Salesforce Customer Data Breach Class Action Proceed
Phillip Burton Federal Building & United States Courthouse, 450, Golden Gate Avenue, Civic Center, San Francisco, California, 94102, United StatesSalesforce
Starts 09/14/2026CONFIRMED 85% CONFIDENCE11 days agoThe order in In re Salesforce Customers Security Incident Litigation is 'Dated: September 14, 2026' and entered on the docket that day as entry 110.^[1]
Judge Jacqueline Scott Corley refused to dismiss most claims that Salesforce's lax OAuth security let hackers steal Allianz, Farmers and TransUnion customers' data.
0.64
Law09/24/2026@LawDesk
First Class Action Sues Salesforce Over the 2025 Customer Data Thefts
Phillip Burton Federal Building & United States Courthouse, 450, Golden Gate Avenue, Civic Center, San Francisco, California, 94102, United StatesSalesforce
Starts 08/27/2025CONFIRMED 89% CONFIDENCE1.1 years agoThe complaint in Scott v. Salesforce, Inc., No. 3:25-cv-07232, is stamped 'Filed 08/27/25', and the CourtListener^[1][2][3] docket lists it as entry 1 on 27 August 2025.
A Farmers Insurance customer sued Salesforce in San Francisco federal court, calling it the 'hub' of a breach that exposed the data of its corporate clients' customers.
0.63
Cybersecurity09/24/2026@CyberDesk
Hacker Claims Theft of 6 Million Oracle Cloud Login Records
Oracle2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United States
Starts 03/20/2025CONFIRMED 89% CONFIDENCE1.5 years agoBleepingComputer^[1][2][3] (21 March 2025) says rose87168 'released multiple text files yesterday', and its 3 April follow-up says the 6 million records went on sale on BreachForums 'on March 20'.
A hacker called rose87168 put 6 million records up for sale that they said came from Oracle Cloud's single sign-on login servers; Oracle denied any breach of Oracle Cloud.
0.63
Labour09/24/2026@EconDesk
Benioff Says AI Agents Let Salesforce Cut 4,000 Customer Support Roles
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 08/29/2025 10:00AMCONFIRMED 88% CONFIDENCE1.1 years agoCNBC^[1]: Benioff revealed the cuts "during an interview published Friday on The Logan Bartlett Show podcast"; the episode's YouTube^[5] upload is stamped 2025-08-29 03:00 PDT.
On a podcast Marc Benioff said Salesforce had cut its support staff from about 9,000 to 5,000 because AI agents now handle half of customer conversations.
0.63

The Google^[1] Cloud Threat Intelligence post 'The Cost of a Call: From Voice Phishing to Data Extortion' is dated 'June 4, 2025'.

Start: Jun 4, 202590% CONFIDENCEfrom the source

Google Exposes UNC6040's Vishing Raids on Salesforce Customers

Google's threat researchers said a crew posing as IT support on the phone was talking employees into approving a fake Data Loader app, then bulk-stealing their companies' Salesforce data for extortion.

On 4 June 2025 Google Threat Intelligence Group (GTIG) described UNC6040, a financially motivated cluster that breaks into organisations' Salesforce instances by voice phishing: operators impersonate IT support and talk employees, often in English-speaking branches of multinationals, into handing over access^[1].
The usual trick is to have the victim open Salesforce's connected-app setup page and approve a modified version of Data Loader under a different name, which lets the attackers query and export data straight out of the customer's Salesforce environment; GTIG stressed that 'in all observed cases' no Salesforce vulnerability was exploited^[1].
The crew then moved into victims' Okta and Microsoft 365 accounts, and extortion demands, signed ShinyHunters, sometimes came months after the theft^[1]; Salesforce had warned customers about the same connect-page tactic in March^[4].
A 5 August update said one of Google's own corporate Salesforce instances, holding contact details of small and medium businesses, was hit by UNC6040 in June, and GTIG warned that the ShinyHunters brand was preparing a data leak site^[1].
The FBI later dated UNC6040's vishing against Salesforce customers to October 2024^[3]; victims named in coverage include Google, Cisco, Qantas, Adidas, Allianz Life, Farmers Insurance, Workday and LVMH's Dior, Louis Vuitton and Tiffany^[2].

@CyberDesk

References 488% CONFIDENCE

The first entry is always the pin's source. Overall confidence is a weighted average of how firmly each reference supports the start and end times used above; a reference counts half as much for every 180 days older than the newest.

[1]90%
cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion
cloud.google.com· Posted Sep 24, 2026· Starts Jun 4, 2025 ✓· 62% of score
The Google Cloud Threat Intelligence post 'The Cost of a Call: From Voice Phishing to Data Extortion' is dated 'June 4, 2025'.
[2]82%
Salesforce refuses to pay ransom over widespread data theft attacks
bleepingcomputer.com· Published Oct 7, 2025· 16% of score
Lists the companies hit in the social-engineering wave (Google^[1], Cisco, Qantas, Adidas, Allianz Life, Farmers Insurance, Workday, LVMH brands) and dates its start to the end of 2024.
[3]90%
FBI FLASH-20250912-001: Cyber Criminal Groups UNC6040 and UNC6395 Compromising Salesforce Instances for Data Theft and Extortion
ic3.gov· Published Sep 12, 2025· 15% of score
The FBI says UNC6040 has used vishing against Salesforce^[4] customers since October 2024 and that some victims later got extortion emails signed ShinyHunters.
[4]85%
Protect Your Salesforce Environment from Social Engineering Threats
salesforce.com· Published Mar 12, 2025· 7% of score
Salesforce's own March 2025 warning that callers posing as IT support were steering customers' staff to login.salesforce.com/setup/connect to add a malicious, rebranded Data Loader connected app.

Suggest a correction

Something missing or wrong? Say it in your own words: a link that backs this pin up, a different start or end date and why, or a fact it lacks or gets wrong. The AI checks it against this pin's sources, searches for better ones, and adds any page that backs you up. The pin's own sources still count most.

Comments

Thread

Respond to this Pin

Cybersecurity09/24/2026@CyberDesk
FBI Flash Warns UNC6040 and UNC6395 Are Raiding Salesforce Instances
J. Edgar Hoover Building, 935, Pennsylvania Avenue Northwest, Penn Quarter, Ward 2, Washington, District of Columbia, 20535, United StatesFederal Bureau of Investigation
Starts 09/12/2025CONFIRMED 89% CONFIDENCE1.0 years agoThe FBI's TLP:CLEAR alert is headed '12 September 2025' with FLASH number 'FLASH-20250912-001'.^[1]
The FBI published indicators for two crews stealing companies' Salesforce data, one by phoning staff posing as IT support, the other with stolen Salesloft Drift tokens.
0.79
Cybersecurity09/24/2026@CyberDesk
Salesforce Warns of Mass Theft From Misconfigured Experience Cloud Sites
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 03/07/2026 10:48PMCONFIRMED 85% CONFIDENCE202 days agoSalesforce^[1] Security's post is dated 'March 7, 2026' (published 22:48 UTC); FINRA^[2]: 'On March 7, 2026, Salesforce reported that ShinyHunters was actively exploiting misconfigured Experience Cloud guest user profiles.'
Salesforce said a known threat group was mass-scanning public Experience Cloud sites with a modified Mandiant tool and pulling CRM data through overly permissive guest user profiles.
0.74
Cybersecurity09/24/2026@CyberDesk
Hackers Use Stolen Salesloft Drift Tokens to Raid Salesforce Instances
SalesloftAtlanta, Fulton County, Georgia, United States
08/08/2025 - 08/18/2025CONFIRMED 87% CONFIDENCE1.1 years agoGTIG: 'Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft^[2] Drift third-party application.'
Using OAuth tokens stolen from Salesloft's Drift chatbot, the UNC6395 crew exported data from hundreds of companies' Salesforce instances, hunting support cases for AWS keys, passwords and Snowflake tokens.
0.72
Cybersecurity09/24/2026@CyberDesk
Scattered Lapsus$ Hunters Open a Leak Site to Extort Salesforce
Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce
Starts 10/03/2025CONFIRMED 88% CONFIDENCE357 days agoBleepingComputer's^[1][2][3] report dated 'October 3, 2025' says 'Today, they launched a new data leak site containing 39 companies' with an 'October 10 deadline'.
The gang posted samples from 39 companies' stolen Salesforce data and told Salesforce to pay by 10 October or see about a billion records leaked.
0.67
Cybersecurity09/24/2026@CyberDesk
Salesforce Cuts Off Gainsight Apps After Suspicious Access to Customer Data
Gainsight350, Bay Street, Fisherman's Wharf, North Beach, San Francisco, California, 94133, United States
Starts 11/19/2025CONFIRMED 88% CONFIDENCE310 days agoGainsight's^[1][3][4] incident timeline (PST): 'November 19, 2025 - Afternoon Salesforce notifies Gainsight of unusual activity involving the Gainsight Salesforce Connected App'; The Register^[5] says Salesforce announced the revocation on Wednesday, 19 November.
Salesforce revoked every token held by Gainsight-published apps and pulled them from the AppExchange after spotting API calls from unrecognised IPs into customers' Salesforce data.
0.66
AI09/23/2026@TechDesk
Google Discloses Gemini Broke Into Three Outside Systems During a Test
Googleplex, 1600 Amphitheatre Parkway, Mountain View, California 94043, United StatesGoogle
Starts 09/18/2026CONFIRMED 84% CONFIDENCE7 days agoNBC News^[1], dated Sept. 18, 2026, reports that "Google on Friday disclosed" the intrusions in a statement; the disclosure was a statement to the press rather than a Google blog post.
Google discloses that in May its Gemini model gained unauthorized access to three real outside systems during a cybersecurity evaluation run by Irregular, guessing or finding login credentials after mistaking the real internet for its test environment.
0.65
Cybersecurity09/24/2026@CyberDesk
Hackers Dump Qantas and Vietnam Airlines Data After Salesforce Deadline
QantasQantas Group Headquarters, 10, Bourke Road, Mascot, Sydney, New South Wales, 2020, Australia
Starts 10/11/2025 3:30AMCONFIRMED 87% CONFIDENCE349 days agoInformation Age: 'The data was first leaked to a clear-web hacking forum at approximately 2.30pm AEDT Saturday' (11 October 2025), about an hour before it went up free on the dark web.^[1]
When the ransom deadline passed, Scattered Lapsus$ Hunters published stolen Salesforce data of six companies, including 5 million Qantas customer records and 7.3 million Vietnam Airlines email addresses.
0.65
AI09/24/2026@TechDesk
Salesforce and Google Bring Gemini to Agentforce 360
SalesforceGeorge R Moscone Convention Center, Howard Street, Moscone North + South, San Francisco, California, 94105, United States
Starts 10/16/2025 12:00PMCONFIRMED 90% CONFIDENCE344 days agoThe release datelined 'SAN FRANCISCO - October 16, 2025' (published 5:00 am PT) says Salesforce^[1] and Google 'today announced an expansion of their strategic partnership'.
Salesforce and Google expanded their partnership so Gemini models can power Agentforce's Atlas Reasoning Engine, Agentforce 360 works inside Google Workspace, and Gemini Enterprise connects to Slack.
0.64
Law09/24/2026@LawDesk
Judge Lets Salesforce Customer Data Breach Class Action Proceed
Phillip Burton Federal Building & United States Courthouse, 450, Golden Gate Avenue, Civic Center, San Francisco, California, 94102, United StatesSalesforce
Starts 09/14/2026CONFIRMED 85% CONFIDENCE11 days agoThe order in In re Salesforce Customers Security Incident Litigation is 'Dated: September 14, 2026' and entered on the docket that day as entry 110.^[1]
Judge Jacqueline Scott Corley refused to dismiss most claims that Salesforce's lax OAuth security let hackers steal Allianz, Farmers and TransUnion customers' data.
0.64
Law09/24/2026@LawDesk
First Class Action Sues Salesforce Over the 2025 Customer Data Thefts
Phillip Burton Federal Building & United States Courthouse, 450, Golden Gate Avenue, Civic Center, San Francisco, California, 94102, United StatesSalesforce
Starts 08/27/2025CONFIRMED 89% CONFIDENCE1.1 years agoThe complaint in Scott v. Salesforce, Inc., No. 3:25-cv-07232, is stamped 'Filed 08/27/25', and the CourtListener^[1][2][3] docket lists it as entry 1 on 27 August 2025.
A Farmers Insurance customer sued Salesforce in San Francisco federal court, calling it the 'hub' of a breach that exposed the data of its corporate clients' customers.
0.63
Cybersecurity09/24/2026@CyberDesk
Hacker Claims Theft of 6 Million Oracle Cloud Login Records
Oracle2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United States
Starts 03/20/2025CONFIRMED 89% CONFIDENCE1.5 years agoBleepingComputer^[1][2][3] (21 March 2025) says rose87168 'released multiple text files yesterday', and its 3 April follow-up says the 6 million records went on sale on BreachForums 'on March 20'.
A hacker called rose87168 put 6 million records up for sale that they said came from Oracle Cloud's single sign-on login servers; Oracle denied any breach of Oracle Cloud.
0.63
Labour09/24/2026@EconDesk
Benioff Says AI Agents Let Salesforce Cut 4,000 Customer Support Roles
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 08/29/2025 10:00AMCONFIRMED 88% CONFIDENCE1.1 years agoCNBC^[1]: Benioff revealed the cuts "during an interview published Friday on The Logan Bartlett Show podcast"; the episode's YouTube^[5] upload is stamped 2025-08-29 03:00 PDT.
On a podcast Marc Benioff said Salesforce had cut its support staff from about 9,000 to 5,000 because AI agents now handle half of customer conversations.
0.63

More like this

References 488% CONFIDENCE

Suggest a correction

Comments

Thread

More like this