Extortion: upcoming dates

Recent

• Cybersecurity09/25/2026@CyberDesk

  WorldLeaks Claims Nike Hack as Nike Probes a Possible Breach

  Nike Philip H. Knight Campus, 1, Merlo Station, Marlene Village, Beaverton, Washington County, Oregon, 97005, United StatesNike

  

  Starts 01/22/2026CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins82% CONFIDENCEOverall confidence: 82%How well the pin's source and references back up its dates.Weighted average of how firmly 6 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better253 days agoSecurityWeek^[1]: Nike "was listed as a victim on the Tor-based leak website operated by the WorldLeaks gang on January 22".

  The WorldLeaks extortion gang listed Nike on its leak site on 22 January 2026 and then dumped about 1.4TB of what it said were 188,347 internal Nike design and manufacturing files; Nike said only that it was investigating a potential cybersecurity incident.

  00
• Cybersecurity09/24/2026@CyberDesk

  Salesforce Tells Customers It Won't Pay the Scattered Lapsus$ Hunters Ransom

  Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce

  

  Starts 10/07/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins86% CONFIDENCEOverall confidence: 86%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better360 days agoBleepingComputer^[1][4], 7 October 2025: 'Salesforce emailed customers on Tuesday to say they would not be paying a ransom' - Tuesday was 7 October.

  With the gang's leak deadline three days away, Salesforce emailed customers that it would not engage, negotiate with or pay any extortion demand.

  00
• Cybersecurity09/24/2026@CyberDesk

  Scattered Lapsus$ Hunters Open a Leak Site to Extort Salesforce

  Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce

  

  Starts 10/03/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins88% CONFIDENCEOverall confidence: 88%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better364 days agoBleepingComputer's^[1][2][3] report dated 'October 3, 2025' says 'Today, they launched a new data leak site containing 39 companies' with an 'October 10 deadline'.

  The gang posted samples from 39 companies' stolen Salesforce data and told Salesforce to pay by 10 October or see about a billion records leaked.

  00
• Cybersecurity09/24/2026@CyberDesk

  Cl0p Starts Emailing Executives Claiming Oracle E-Business Suite Data Theft

  2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle

  

  Starts 09/29/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins87% CONFIDENCEOverall confidence: 87%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better1.0 years agoGoogle^[1] Threat Intelligence Group: 'Beginning Sept. 29, 2025, Google Threat Intelligence Group (GTIG) and Mandiant began tracking a new, large-scale extortion campaign by a threat actor claiming affiliation with the CL0P extortion brand.'

  A group using the Cl0p extortion brand began mass-emailing executives, saying it had stolen data from their companies' Oracle E-Business Suite systems and demanding payment.

  10
• Cybersecurity09/24/2026@CyberDesk

  FBI Flash Warns UNC6040 and UNC6395 Are Raiding Salesforce Instances

  J. Edgar Hoover Building, 935, Pennsylvania Avenue Northwest, Penn Quarter, Ward 2, Washington, District of Columbia, 20535, United StatesFederal Bureau of Investigation

  

  Starts 09/12/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins89% CONFIDENCEOverall confidence: 89%How well the pin's source and references back up its dates.Weighted average of how firmly 3 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better1.1 years agoThe FBI's TLP:CLEAR alert is headed '12 September 2025' with FLASH number 'FLASH-20250912-001'.^[1]

  The FBI published indicators for two crews stealing companies' Salesforce data, one by phoning staff posing as IT support, the other with stolen Salesloft Drift tokens.

  00
• Cybersecurity09/24/2026@CyberDesk

  Google Exposes UNC6040's Vishing Raids on Salesforce Customers

  Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce

  

  Starts 06/04/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins88% CONFIDENCEOverall confidence: 88%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better1.3 years agoThe Google^[1] Cloud Threat Intelligence post 'The Cost of a Call: From Voice Phishing to Data Extortion' is dated 'June 4, 2025'.

  Google's threat researchers said a crew posing as IT support on the phone was talking employees into approving a fake Data Loader app, then bulk-stealing their companies' Salesforce data for extortion.

  00
• Cybersecurity09/24/2026@CyberDesk

  Oracle Health Breach of Legacy Cerner Servers Exposes Patient Data

  Cerner Corporation, North Kansas City, Clay County, Missouri, 64117, United StatesOracle

  

  Starts 03/28/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins89% CONFIDENCEOverall confidence: 89%How well the pin's source and references back up its dates.Weighted average of how firmly 3 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better1.5 years agoBleepingComputer^[1][3], 28 March 2025: 'A breach at Oracle Health impacts multiple US healthcare organizations and hospitals', reported from Oracle Health's notice to customers while 'Oracle Health has not yet publicly disclosed the incident'.

  Attackers copied patient data from old Cerner data-migration servers that Oracle Health had not yet moved to Oracle Cloud, and US hospitals were then extorted over it.

  00