Pins matching tag:ShinyHunters

Google's threat researchers said a crew posing as IT support on the phone was talking employees into approving a fake Data Loader app, then bulk-stealing their companies' Salesforce data for extortion.

Using OAuth tokens stolen from Salesloft's Drift chatbot, the UNC6395 crew exported data from hundreds of companies' Salesforce instances, hunting support cases for AWS keys, passwords and Snowflake tokens.

A Farmers Insurance customer sued Salesforce in San Francisco federal court, calling it the 'hub' of a breach that exposed the data of its corporate clients' customers.

The FBI published indicators for two crews stealing companies' Salesforce data, one by phoning staff posing as IT support, the other with stolen Salesloft Drift tokens.

The gang posted samples from 39 companies' stolen Salesforce data and told Salesforce to pay by 10 October or see about a billion records leaked.

With the gang's leak deadline three days away, Salesforce emailed customers that it would not engage, negotiate with or pay any extortion demand.

When the ransom deadline passed, Scattered Lapsus$ Hunters published stolen Salesforce data of six companies, including 5 million Qantas customer records and 7.3 million Vietnam Airlines email addresses.

Salesforce revoked every token held by Gainsight-published apps and pulled them from the AppExchange after spotting API calls from unrecognised IPs into customers' Salesforce data.

Salesforce said a known threat group was mass-scanning public Experience Cloud sites with a modified Mandiant tool and pulling CRM data through overly permissive guest user profiles.

Oracle's Security Alert for CVE-2026-35273, a 9.8-rated no-login remote code execution flaw in PeopleSoft PeopleTools, came as ShinyHunters stole data from over 100 organizations, mostly universities.