Cybersecurity09/24/2026@CyberDesk
Scattered Lapsus$ Hunters Open a Leak Site to Extort Salesforce
Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce
Starts 10/03/2025CONFIRMED 88% CONFIDENCE357 days agoBleepingComputer's^[1][2][3] report dated 'October 3, 2025' says 'Today, they launched a new data leak site containing 39 companies' with an 'October 10 deadline'.
The gang posted samples from 39 companies' stolen Salesforce data and told Salesforce to pay by 10 October or see about a billion records leaked.
0.76
Cybersecurity09/24/2026@CyberDesk
Hackers Dump Qantas and Vietnam Airlines Data After Salesforce Deadline
QantasQantas Group Headquarters, 10, Bourke Road, Mascot, Sydney, New South Wales, 2020, Australia
Starts 10/11/2025 3:30AMCONFIRMED 87% CONFIDENCE349 days agoInformation Age: 'The data was first leaked to a clear-web hacking forum at approximately 2.30pm AEDT Saturday' (11 October 2025), about an hour before it went up free on the dark web.^[1]
When the ransom deadline passed, Scattered Lapsus$ Hunters published stolen Salesforce data of six companies, including 5 million Qantas customer records and 7.3 million Vietnam Airlines email addresses.
0.71
Cybersecurity09/24/2026@CyberDesk
Salesforce Warns of Mass Theft From Misconfigured Experience Cloud Sites
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 03/07/2026 10:48PMCONFIRMED 85% CONFIDENCE202 days agoSalesforce^[1] Security's post is dated 'March 7, 2026' (published 22:48 UTC); FINRA^[2]: 'On March 7, 2026, Salesforce reported that ShinyHunters was actively exploiting misconfigured Experience Cloud guest user profiles.'
Salesforce said a known threat group was mass-scanning public Experience Cloud sites with a modified Mandiant tool and pulling CRM data through overly permissive guest user profiles.
0.67
Law09/24/2026@LawDesk
First Class Action Sues Salesforce Over the 2025 Customer Data Thefts
Phillip Burton Federal Building & United States Courthouse, 450, Golden Gate Avenue, Civic Center, San Francisco, California, 94102, United StatesSalesforce
Starts 08/27/2025CONFIRMED 89% CONFIDENCE1.1 years agoThe complaint in Scott v. Salesforce, Inc., No. 3:25-cv-07232, is stamped 'Filed 08/27/25', and the CourtListener^[1][2][3] docket lists it as entry 1 on 27 August 2025.
A Farmers Insurance customer sued Salesforce in San Francisco federal court, calling it the 'hub' of a breach that exposed the data of its corporate clients' customers.
0.67
Cybersecurity09/24/2026@CyberDesk
FBI Flash Warns UNC6040 and UNC6395 Are Raiding Salesforce Instances
J. Edgar Hoover Building, 935, Pennsylvania Avenue Northwest, Penn Quarter, Ward 2, Washington, District of Columbia, 20535, United StatesFederal Bureau of Investigation
Starts 09/12/2025CONFIRMED 89% CONFIDENCE1.0 years agoThe FBI's TLP:CLEAR alert is headed '12 September 2025' with FLASH number 'FLASH-20250912-001'.^[1]
The FBI published indicators for two crews stealing companies' Salesforce data, one by phoning staff posing as IT support, the other with stolen Salesloft Drift tokens.
0.67
Cybersecurity09/24/2026@CyberDesk
Google Exposes UNC6040's Vishing Raids on Salesforce Customers
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 06/04/2025CONFIRMED 88% CONFIDENCE1.3 years agoThe Google^[1] Cloud Threat Intelligence post 'The Cost of a Call: From Voice Phishing to Data Extortion' is dated 'June 4, 2025'.
Google's threat researchers said a crew posing as IT support on the phone was talking employees into approving a fake Data Loader app, then bulk-stealing their companies' Salesforce data for extortion.
0.66
Law09/24/2026@LawDesk
Judge Lets Salesforce Customer Data Breach Class Action Proceed
Phillip Burton Federal Building & United States Courthouse, 450, Golden Gate Avenue, Civic Center, San Francisco, California, 94102, United StatesSalesforce
Starts 09/14/2026CONFIRMED 85% CONFIDENCE11 days agoThe order in In re Salesforce Customers Security Incident Litigation is 'Dated: September 14, 2026' and entered on the docket that day as entry 110.^[1]
Judge Jacqueline Scott Corley refused to dismiss most claims that Salesforce's lax OAuth security let hackers steal Allianz, Farmers and TransUnion customers' data.
0.66
Finance09/24/2026@TechDesk
Salesforce's $25 Billion Accelerated Share Repurchase Settles
Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce
Starts 10/31/2026ESTIMATED 75% CONFIDENCEin 36 daysEstimated: the Q2 FY2027 release says "Final settlement of the company's $25 billion ASR is expected in October 2026", so the pin takes the month's last day; the March release had said "the third or fourth quarter of Salesforce's FY27".^[1]
Final settlement of Salesforce's record $25 billion accelerated share repurchase, when the banks deliver the last of the shares beyond the 103 million received up front in March.
0.66
Cybersecurity09/24/2026@CyberDesk
Hackers Use Stolen Salesloft Drift Tokens to Raid Salesforce Instances
SalesloftAtlanta, Fulton County, Georgia, United States
08/08/2025 - 08/18/2025CONFIRMED 87% CONFIDENCE1.1 years agoGTIG: 'Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft^[2] Drift third-party application.'
Using OAuth tokens stolen from Salesloft's Drift chatbot, the UNC6395 crew exported data from hundreds of companies' Salesforce instances, hunting support cases for AWS keys, passwords and Snowflake tokens.
0.65
Labour09/24/2026@EconDesk
Benioff Says AI Agents Let Salesforce Cut 4,000 Customer Support Roles
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 08/29/2025 10:00AMCONFIRMED 88% CONFIDENCE1.1 years agoCNBC^[1]: Benioff revealed the cuts "during an interview published Friday on The Logan Bartlett Show podcast"; the episode's YouTube^[5] upload is stamped 2025-08-29 03:00 PDT.
On a podcast Marc Benioff said Salesforce had cut its support staff from about 9,000 to 5,000 because AI agents now handle half of customer conversations.
0.64
Labour09/24/2026@EconDesk
Salesforce Lays Off 262 at Its San Francisco Headquarters
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 09/02/2025CONFIRMED 91% CONFIDENCE1.1 years agoStated as firm: California EDD's WARN report lists Salesforce, Inc., 415 Mission Street, notice date 09/02/2025, 262 permanent layoffs effective 11/03/2025; the SF Examiner^[1]: "The notice of the cuts, which the company filed Tuesday with the state Employment Development Department".
Salesforce told California it would permanently cut 262 jobs at Salesforce Tower, days after Marc Benioff said AI had let him shrink customer support from 9,000 people to about 5,000.
0.64
Finance09/24/2026@TechDesk
Salesforce Starts Its Record $25 Billion Accelerated Share Repurchase
Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce
Starts 03/16/2026 1:03PMCONFIRMED 91% CONFIDENCE193 days agoThe release is datelined "SAN FRANCISCO—March 16, 2026" and says Salesforce^[1] "today commenced the prepayment and initial delivery"; the Business Wire copy is stamped "Mar 16, 2026 9:03am EDT".
Salesforce prepaid $25 billion to five banks and took delivery of about 103 million of its own shares, roughly 80% of the total, in what it called the largest accelerated share repurchase in history.
$25B
0.64

BleepingComputer^[1][4], 7 October 2025: 'Salesforce emailed customers on Tuesday to say they would not be paying a ransom' - Tuesday was 7 October.

Start: Oct 7, 202590% CONFIDENCEfrom the source

Salesforce Tells Customers It Won't Pay the Scattered Lapsus$ Hunters Ransom

With the gang's leak deadline three days away, Salesforce emailed customers that it would not engage, negotiate with or pay any extortion demand.

On Tuesday 7 October 2025 Salesforce emailed customers that it would not pay the hackers extorting it, warning that 'credible threat intelligence' showed they planned to leak the stolen data; a spokesperson confirmed: 'Salesforce will not engage, negotiate with, or pay any extortion demand'^[1].
The statement answered Scattered Lapsus$ Hunters' leak site, which claimed nearly 1 billion records from 39 companies and asked Salesforce for a single payment to cover all of them before a 10 October deadline^[1][4].
The data came from two 2025 campaigns: vishing that tricked staff into linking a malicious OAuth app, which hit Google, Cisco, Qantas, Adidas, Allianz Life, Farmers Insurance, Workday, Kering and LVMH brands, and the August Salesloft Drift token thefts^[1].
The same day the breachforums[.]hn leak site went offline, its domain moved to Cloudflare name servers previously used in FBI seizures^[1].
Salesforce kept to the refusal after the deadline passed and the gang began publishing data^[2][3].

@CyberDesk

References 486% CONFIDENCE

The first entry is always the pin's source. Overall confidence is a weighted average of how firmly each reference supports the start and end times used above; a reference counts half as much for every 180 days older than the newest.

[1]90%
bleepingcomputer.com/news/security/salesforce-refuses-to-pay-ransom-over-widespread-data-theft-attacks
bleepingcomputer.com· Posted Sep 24, 2026· Starts Oct 7, 2025 ✓· 56% of score
BleepingComputer^[4], 7 October 2025: 'Salesforce emailed customers on Tuesday to say they would not be paying a ransom' - Tuesday was 7 October.
[2]80%
How to tell if your Qantas personal data has hit the dark web and what you can do if it has
abc.net.au· Published Oct 13, 2025· 15% of score
ABC News quotes Salesforce saying it 'will not engage, negotiate with, or pay any extortion demand' in the week before Qantas data was dumped.
[3]78%
Scattered Lapsus$ Hunters Leak First Wave of Salesforce Victim Data
cyberinsider.com· Published Oct 13, 2025· 15% of score
Says Salesforce reiterated its refusal to negotiate or pay and attributed the incidents to customer misconfigurations, third-party integrations or legacy tokens rather than a platform flaw.^[1]
[4]85%
ShinyHunters launches Salesforce data leak site to extort 39 victims
bleepingcomputer.com· Published Oct 3, 2025· 14% of score
The leak site's separate ransom demand to Salesforce for about 1 billion records and the 10 October deadline that the refusal answered.^[1]

Suggest a correction

Something missing or wrong? Say it in your own words: a link that backs this pin up, a different start or end date and why, or a fact it lacks or gets wrong. The AI checks it against this pin's sources, searches for better ones, and adds any page that backs you up. The pin's own sources still count most.

Comments

Thread

Respond to this Pin

Cybersecurity09/24/2026@CyberDesk
Scattered Lapsus$ Hunters Open a Leak Site to Extort Salesforce
Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce
Starts 10/03/2025CONFIRMED 88% CONFIDENCE357 days agoBleepingComputer's^[1][2][3] report dated 'October 3, 2025' says 'Today, they launched a new data leak site containing 39 companies' with an 'October 10 deadline'.
The gang posted samples from 39 companies' stolen Salesforce data and told Salesforce to pay by 10 October or see about a billion records leaked.
0.76
Cybersecurity09/24/2026@CyberDesk
Hackers Dump Qantas and Vietnam Airlines Data After Salesforce Deadline
QantasQantas Group Headquarters, 10, Bourke Road, Mascot, Sydney, New South Wales, 2020, Australia
Starts 10/11/2025 3:30AMCONFIRMED 87% CONFIDENCE349 days agoInformation Age: 'The data was first leaked to a clear-web hacking forum at approximately 2.30pm AEDT Saturday' (11 October 2025), about an hour before it went up free on the dark web.^[1]
When the ransom deadline passed, Scattered Lapsus$ Hunters published stolen Salesforce data of six companies, including 5 million Qantas customer records and 7.3 million Vietnam Airlines email addresses.
0.71
Cybersecurity09/24/2026@CyberDesk
Salesforce Warns of Mass Theft From Misconfigured Experience Cloud Sites
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 03/07/2026 10:48PMCONFIRMED 85% CONFIDENCE202 days agoSalesforce^[1] Security's post is dated 'March 7, 2026' (published 22:48 UTC); FINRA^[2]: 'On March 7, 2026, Salesforce reported that ShinyHunters was actively exploiting misconfigured Experience Cloud guest user profiles.'
Salesforce said a known threat group was mass-scanning public Experience Cloud sites with a modified Mandiant tool and pulling CRM data through overly permissive guest user profiles.
0.67
Law09/24/2026@LawDesk
First Class Action Sues Salesforce Over the 2025 Customer Data Thefts
Phillip Burton Federal Building & United States Courthouse, 450, Golden Gate Avenue, Civic Center, San Francisco, California, 94102, United StatesSalesforce
Starts 08/27/2025CONFIRMED 89% CONFIDENCE1.1 years agoThe complaint in Scott v. Salesforce, Inc., No. 3:25-cv-07232, is stamped 'Filed 08/27/25', and the CourtListener^[1][2][3] docket lists it as entry 1 on 27 August 2025.
A Farmers Insurance customer sued Salesforce in San Francisco federal court, calling it the 'hub' of a breach that exposed the data of its corporate clients' customers.
0.67
Cybersecurity09/24/2026@CyberDesk
FBI Flash Warns UNC6040 and UNC6395 Are Raiding Salesforce Instances
J. Edgar Hoover Building, 935, Pennsylvania Avenue Northwest, Penn Quarter, Ward 2, Washington, District of Columbia, 20535, United StatesFederal Bureau of Investigation
Starts 09/12/2025CONFIRMED 89% CONFIDENCE1.0 years agoThe FBI's TLP:CLEAR alert is headed '12 September 2025' with FLASH number 'FLASH-20250912-001'.^[1]
The FBI published indicators for two crews stealing companies' Salesforce data, one by phoning staff posing as IT support, the other with stolen Salesloft Drift tokens.
0.67
Cybersecurity09/24/2026@CyberDesk
Google Exposes UNC6040's Vishing Raids on Salesforce Customers
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 06/04/2025CONFIRMED 88% CONFIDENCE1.3 years agoThe Google^[1] Cloud Threat Intelligence post 'The Cost of a Call: From Voice Phishing to Data Extortion' is dated 'June 4, 2025'.
Google's threat researchers said a crew posing as IT support on the phone was talking employees into approving a fake Data Loader app, then bulk-stealing their companies' Salesforce data for extortion.
0.66
Law09/24/2026@LawDesk
Judge Lets Salesforce Customer Data Breach Class Action Proceed
Phillip Burton Federal Building & United States Courthouse, 450, Golden Gate Avenue, Civic Center, San Francisco, California, 94102, United StatesSalesforce
Starts 09/14/2026CONFIRMED 85% CONFIDENCE11 days agoThe order in In re Salesforce Customers Security Incident Litigation is 'Dated: September 14, 2026' and entered on the docket that day as entry 110.^[1]
Judge Jacqueline Scott Corley refused to dismiss most claims that Salesforce's lax OAuth security let hackers steal Allianz, Farmers and TransUnion customers' data.
0.66
Finance09/24/2026@TechDesk
Salesforce's $25 Billion Accelerated Share Repurchase Settles
Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce
Starts 10/31/2026ESTIMATED 75% CONFIDENCEin 36 daysEstimated: the Q2 FY2027 release says "Final settlement of the company's $25 billion ASR is expected in October 2026", so the pin takes the month's last day; the March release had said "the third or fourth quarter of Salesforce's FY27".^[1]
Final settlement of Salesforce's record $25 billion accelerated share repurchase, when the banks deliver the last of the shares beyond the 103 million received up front in March.
0.66
Cybersecurity09/24/2026@CyberDesk
Hackers Use Stolen Salesloft Drift Tokens to Raid Salesforce Instances
SalesloftAtlanta, Fulton County, Georgia, United States
08/08/2025 - 08/18/2025CONFIRMED 87% CONFIDENCE1.1 years agoGTIG: 'Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft^[2] Drift third-party application.'
Using OAuth tokens stolen from Salesloft's Drift chatbot, the UNC6395 crew exported data from hundreds of companies' Salesforce instances, hunting support cases for AWS keys, passwords and Snowflake tokens.
0.65
Labour09/24/2026@EconDesk
Benioff Says AI Agents Let Salesforce Cut 4,000 Customer Support Roles
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 08/29/2025 10:00AMCONFIRMED 88% CONFIDENCE1.1 years agoCNBC^[1]: Benioff revealed the cuts "during an interview published Friday on The Logan Bartlett Show podcast"; the episode's YouTube^[5] upload is stamped 2025-08-29 03:00 PDT.
On a podcast Marc Benioff said Salesforce had cut its support staff from about 9,000 to 5,000 because AI agents now handle half of customer conversations.
0.64
Labour09/24/2026@EconDesk
Salesforce Lays Off 262 at Its San Francisco Headquarters
SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States
Starts 09/02/2025CONFIRMED 91% CONFIDENCE1.1 years agoStated as firm: California EDD's WARN report lists Salesforce, Inc., 415 Mission Street, notice date 09/02/2025, 262 permanent layoffs effective 11/03/2025; the SF Examiner^[1]: "The notice of the cuts, which the company filed Tuesday with the state Employment Development Department".
Salesforce told California it would permanently cut 262 jobs at Salesforce Tower, days after Marc Benioff said AI had let him shrink customer support from 9,000 people to about 5,000.
0.64
Finance09/24/2026@TechDesk
Salesforce Starts Its Record $25 Billion Accelerated Share Repurchase
Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce
Starts 03/16/2026 1:03PMCONFIRMED 91% CONFIDENCE193 days agoThe release is datelined "SAN FRANCISCO—March 16, 2026" and says Salesforce^[1] "today commenced the prepayment and initial delivery"; the Business Wire copy is stamped "Mar 16, 2026 9:03am EDT".
Salesforce prepaid $25 billion to five banks and took delivery of about 103 million of its own shares, roughly 80% of the total, in what it called the largest accelerated share repurchase in history.
$25B
0.64

More like this

References 486% CONFIDENCE

Suggest a correction

Comments

Thread

More like this