More like this
Google Exposes UNC6040's Vishing Raids on Salesforce Customers
CONFIRMED88% CONFIDENCE1.3 years agoThe Google[1] Cloud Threat Intelligence post 'The Cost of a Call: From Voice Phishing to Data Extortion' is dated 'June 4, 2025'.Google's threat researchers said a crew posing as IT support on the phone was talking employees into approving a fake Data Loader app, then bulk-stealing their companies' Salesforce data for extortion.0.74Salesforce Warns of Mass Theft From Misconfigured Experience Cloud Sites
CONFIRMED85% CONFIDENCE201 days agoSalesforce[1] Security's post is dated 'March 7, 2026' (published 22:48 UTC); FINRA[2]: 'On March 7, 2026, Salesforce reported that ShinyHunters was actively exploiting misconfigured Experience Cloud guest user profiles.'Salesforce said a known threat group was mass-scanning public Experience Cloud sites with a modified Mandiant tool and pulling CRM data through overly permissive guest user profiles.0.73Hackers Use Stolen Salesloft Drift Tokens to Raid Salesforce Instances
CONFIRMED87% CONFIDENCE1.1 years agoGTIG: 'Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft[2] Drift third-party application.'Using OAuth tokens stolen from Salesloft's Drift chatbot, the UNC6395 crew exported data from hundreds of companies' Salesforce instances, hunting support cases for AWS keys, passwords and Snowflake tokens.0.71Scattered Lapsus$ Hunters Open a Leak Site to Extort Salesforce
Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce…
CONFIRMED88% CONFIDENCE356 days agoBleepingComputer's[1][2][3] report dated 'October 3, 2025' says 'Today, they launched a new data leak site containing 39 companies' with an 'October 10 deadline'.The gang posted samples from 39 companies' stolen Salesforce data and told Salesforce to pay by 10 October or see about a billion records leaked.0.66Salesforce Tells Customers It Won't Pay the Scattered Lapsus$ Hunters Ransom
CONFIRMED86% CONFIDENCE352 days agoBleepingComputer[1][4], 7 October 2025: 'Salesforce emailed customers on Tuesday to say they would not be paying a ransom' - Tuesday was 7 October.With the gang's leak deadline three days away, Salesforce emailed customers that it would not engage, negotiate with or pay any extortion demand.0.65Cl0p Starts Emailing Executives Claiming Oracle E-Business Suite Data Theft
CONFIRMED87% CONFIDENCE360 days agoGoogle[1] Threat Intelligence Group: 'Beginning Sept. 29, 2025, Google Threat Intelligence Group (GTIG) and Mandiant began tracking a new, large-scale extortion campaign by a threat actor claiming affiliation with the CL0P extortion brand.'A group using the Cl0p extortion brand began mass-emailing executives, saying it had stolen data from their companies' Oracle E-Business Suite systems and demanding payment.0.64Hackers Dump Qantas and Vietnam Airlines Data After Salesforce Deadline
CONFIRMED87% CONFIDENCE348 days agoInformation Age: 'The data was first leaked to a clear-web hacking forum at approximately 2.30pm AEDT Saturday' (11 October 2025), about an hour before it went up free on the dark web.[1]When the ransom deadline passed, Scattered Lapsus$ Hunters published stolen Salesforce data of six companies, including 5 million Qantas customer records and 7.3 million Vietnam Airlines email addresses.0.64Salesforce Cuts Off Gainsight Apps After Suspicious Access to Customer Data
CONFIRMED88% CONFIDENCE309 days agoGainsight's[1][3][4] incident timeline (PST): 'November 19, 2025 - Afternoon Salesforce notifies Gainsight of unusual activity involving the Gainsight Salesforce Connected App'; The Register[5] says Salesforce announced the revocation on Wednesday, 19 November.Salesforce revoked every token held by Gainsight-published apps and pulled them from the AppExchange after spotting API calls from unrecognised IPs into customers' Salesforce data.0.62First Class Action Sues Salesforce Over the 2025 Customer Data Thefts
Phillip Burton Federal Building & United States Courthouse, 450, Golden Gate Avenue, Civic Center, San Francisco, California, 94102, United StatesSalesforce…
CONFIRMED89% CONFIDENCE1.1 years agoThe complaint in Scott v. Salesforce, Inc., No. 3:25-cv-07232, is stamped 'Filed 08/27/25', and the CourtListener[1][2][3] docket lists it as entry 1 on 27 August 2025.A Farmers Insurance customer sued Salesforce in San Francisco federal court, calling it the 'hub' of a breach that exposed the data of its corporate clients' customers.0.62Judge Lets Salesforce Customer Data Breach Class Action Proceed
Phillip Burton Federal Building & United States Courthouse, 450, Golden Gate Avenue, Civic Center, San Francisco, California, 94102, United StatesSalesforce…
CONFIRMED85% CONFIDENCE10 days agoThe order in In re Salesforce Customers Security Incident Litigation is 'Dated: September 14, 2026' and entered on the docket that day as entry 110.[1]Judge Jacqueline Scott Corley refused to dismiss most claims that Salesforce's lax OAuth security let hackers steal Allianz, Farmers and TransUnion customers' data.0.62Salesforce's Dreamforce 2025 Takes Over the Moscone Center
CONFIRMED88% CONFIDENCE345 days agoStated as firm, per the Salesforce[1][6] Ventures guide (salesforceventures.com[2]): "GUIDE TO DREAMFORCE October 14-16, 2025 San Francisco, CA"; TechCrunch[4]: "its annual Dreamforce customer conference that kicks off October 14".Salesforce's 23rd Dreamforce filled the Moscone Center for three days of more than 1,500 sessions, built around the newly released Agentforce 360 and Marc Benioff's pitch for the 'Agentic Enterprise'.0.61Benioff Says AI Agents Let Salesforce Cut 4,000 Customer Support Roles
CONFIRMED88% CONFIDENCE1.1 years agoCNBC[1]: Benioff revealed the cuts "during an interview published Friday on The Logan Bartlett Show podcast"; the episode's YouTube[5] upload is stamped 2025-08-29 03:00 PDT.On a podcast Marc Benioff said Salesforce had cut its support staff from about 9,000 to 5,000 because AI agents now handle half of customer conversations.0.61
