Chronopin: Date tracker for historical and future events

Cybersecurity09/24/2026@CyberDesk

Hacker Claims Theft of 6 Million Oracle Cloud Login Records

Oracle2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United States

Starts 03/20/2025CONFIRMED 89% CONFIDENCEBleepingComputer^[1][2][3] (21 March 2025) says rose87168 'released multiple text files yesterday', and its 3 April follow-up says the 6 million records went on sale on BreachForums 'on March 20'.

A hacker called rose87168 put 6 million records up for sale that they said came from Oracle Cloud's single sign-on login servers; Oracle denied any breach of Oracle Cloud.

1.00

Cybersecurity09/24/2026@CyberDesk

Oracle Health Breach of Legacy Cerner Servers Exposes Patient Data

OracleCerner Corporation, North Kansas City, Clay County, Missouri, 64117, United States

Starts 03/28/2025CONFIRMED 89% CONFIDENCEBleepingComputer^[1][3], 28 March 2025: 'A breach at Oracle Health impacts multiple US healthcare organizations and hospitals', reported from Oracle Health's notice to customers while 'Oracle Health has not yet publicly disclosed the incident'.

Attackers copied patient data from old Cerner data-migration servers that Oracle Health had not yet moved to Oracle Cloud, and US hospitals were then extorted over it.

1.00

Cybersecurity09/24/2026@CyberDesk

Google Exposes UNC6040's Vishing Raids on Salesforce Customers

SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States

Starts 06/04/2025CONFIRMED 88% CONFIDENCEThe Google^[1] Cloud Threat Intelligence post 'The Cost of a Call: From Voice Phishing to Data Extortion' is dated 'June 4, 2025'.

Google's threat researchers said a crew posing as IT support on the phone was talking employees into approving a fake Data Loader app, then bulk-stealing their companies' Salesforce data for extortion.

1.00

Law09/24/2026@LawDesk

Oracle Health Breach Suits Consolidated in Kansas City Federal Court

Charles Evans Whittaker U.S. Courthouse, 816, Locust Street, Central Downtown, Downtown Kansas City, Kansas City, Jackson County, Missouri, 64106, United States

Oracle

Starts 06/30/2025CONFIRMED 89% CONFIDENCEThe Order Consolidating Cases in No. 25-00259-CV-W-BP is signed 'Date: June 30, 2025' by Beth Phillips, Chief Judge, 'following a telephone conference with the parties held June 30, 2025'.^[1]

Chief Judge Beth Phillips combined 17 patient class actions against Cerner, doing business as Oracle Health, into In re: Cerner/Oracle Data Breach Litigation.

1.00

Cybersecurity09/24/2026@CyberDesk

Hackers Use Stolen Salesloft Drift Tokens to Raid Salesforce Instances

SalesloftAtlanta, Fulton County, Georgia, United States

08/08/2025 - 08/18/2025CONFIRMED 87% CONFIDENCEGTIG: 'Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft^[2] Drift third-party application.'

Using OAuth tokens stolen from Salesloft's Drift chatbot, the UNC6395 crew exported data from hundreds of companies' Salesforce instances, hunting support cases for AWS keys, passwords and Snowflake tokens.

1.00

Law09/24/2026@LawDesk

First Class Action Sues Salesforce Over the 2025 Customer Data Thefts

Phillip Burton Federal Building & United States Courthouse, 450, Golden Gate Avenue, Civic Center, San Francisco, California, 94102, United StatesSalesforce

Starts 08/27/2025CONFIRMED 89% CONFIDENCEThe complaint in Scott v. Salesforce, Inc., No. 3:25-cv-07232, is stamped 'Filed 08/27/25', and the CourtListener^[1][2][3] docket lists it as entry 1 on 27 August 2025.

A Farmers Insurance customer sued Salesforce in San Francisco federal court, calling it the 'hub' of a breach that exposed the data of its corporate clients' customers.

1.00

Cybersecurity09/24/2026@CyberDesk

Salesforce Tells Customers It Won't Pay the Scattered Lapsus$ Hunters Ransom

SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States

Starts 10/07/2025CONFIRMED 86% CONFIDENCEBleepingComputer^[1][4], 7 October 2025: 'Salesforce emailed customers on Tuesday to say they would not be paying a ransom' - Tuesday was 7 October.

With the gang's leak deadline three days away, Salesforce emailed customers that it would not engage, negotiate with or pay any extortion demand.

1.00

Cybersecurity09/24/2026@CyberDesk

Hackers Dump Qantas and Vietnam Airlines Data After Salesforce Deadline

QantasQantas Group Headquarters, 10, Bourke Road, Mascot, Sydney, New South Wales, 2020, Australia

Starts 10/11/2025 3:30AMCONFIRMED 87% CONFIDENCEInformation Age: 'The data was first leaked to a clear-web hacking forum at approximately 2.30pm AEDT Saturday' (11 October 2025), about an hour before it went up free on the dark web.^[1]

When the ransom deadline passed, Scattered Lapsus$ Hunters published stolen Salesforce data of six companies, including 5 million Qantas customer records and 7.3 million Vietnam Airlines email addresses.

1.00

Cybersecurity09/24/2026@CyberDesk

Salesforce Cuts Off Gainsight Apps After Suspicious Access to Customer Data

Gainsight350, Bay Street, Fisherman's Wharf, North Beach, San Francisco, California, 94133, United States

Starts 11/19/2025CONFIRMED 88% CONFIDENCEGainsight's^[1][3][4] incident timeline (PST): 'November 19, 2025 - Afternoon Salesforce notifies Gainsight of unusual activity involving the Gainsight Salesforce Connected App'; The Register^[5] says Salesforce announced the revocation on Wednesday, 19 November.

Salesforce revoked every token held by Gainsight-published apps and pulled them from the AppExchange after spotting API calls from unrecognised IPs into customers' Salesforce data.

1.00

Law09/24/2026@LawDesk

Oracle E-Business Suite Breach Suits Consolidated in Austin

United States Courthouse, 501, West 5th Street, Warehouse District, Austin, Travis County, Texas, 78701, United States

Oracle

Starts 01/05/2026CONFIRMED 86% CONFIDENCEThe order in No. 1:25-cv-01805-ADA-SH is 'SIGNED on January 5, 2026' by Susan Hightower, United States Magistrate Judge.^[1]

A federal magistrate judge combined 33 class actions over the Cl0p theft of Oracle E-Business Suite data into In re Oracle Corporation Data Breach Litigation.

1.00

Cybersecurity09/24/2026@CyberDesk

Salesforce Warns of Mass Theft From Misconfigured Experience Cloud Sites

SalesforceSalesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United States

Starts 03/07/2026 10:48PMCONFIRMED 85% CONFIDENCESalesforce^[1] Security's post is dated 'March 7, 2026' (published 22:48 UTC); FINRA^[2]: 'On March 7, 2026, Salesforce reported that ShinyHunters was actively exploiting misconfigured Experience Cloud guest user profiles.'

Salesforce said a known threat group was mass-scanning public Experience Cloud sites with a modified Mandiant tool and pulling CRM data through overly permissive guest user profiles.

1.00

Law09/24/2026@LawDesk

Judge Lets Salesforce Customer Data Breach Class Action Proceed

Phillip Burton Federal Building & United States Courthouse, 450, Golden Gate Avenue, Civic Center, San Francisco, California, 94102, United StatesSalesforce

Starts 09/14/2026CONFIRMED 85% CONFIDENCEThe order in In re Salesforce Customers Security Incident Litigation is 'Dated: September 14, 2026' and entered on the docket that day as entry 110.^[1]

Judge Jacqueline Scott Corley refused to dismiss most claims that Salesforce's lax OAuth security let hackers steal Allianz, Farmers and TransUnion customers' data.

1.00

Pins matching tag:Breach