Scattered Lapsus$ Hunters: upcoming dates

Recent

• Cybersecurity09/24/2026@CyberDesk

  Hackers Dump Qantas and Vietnam Airlines Data After Salesforce Deadline

  Qantas Group Headquarters, 10, Bourke Road, Mascot, Sydney, New South Wales, 2020, AustraliaQantas

  

  Starts 10/11/2025 3:30AM UTCCONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins87% CONFIDENCEOverall confidence: 87%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better356 days agoInformation Age: 'The data was first leaked to a clear-web hacking forum at approximately 2.30pm AEDT Saturday' (11 October 2025), about an hour before it went up free on the dark web.^[1]

  When the ransom deadline passed, Scattered Lapsus$ Hunters published stolen Salesforce data of six companies, including 5 million Qantas customer records and 7.3 million Vietnam Airlines email addresses.

  00
• Cybersecurity09/24/2026@CyberDesk

  Salesforce Tells Customers It Won't Pay the Scattered Lapsus$ Hunters Ransom

  Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce

  

  Starts 10/07/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins86% CONFIDENCEOverall confidence: 86%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better360 days agoBleepingComputer^[1][4], 7 October 2025: 'Salesforce emailed customers on Tuesday to say they would not be paying a ransom' - Tuesday was 7 October.

  With the gang's leak deadline three days away, Salesforce emailed customers that it would not engage, negotiate with or pay any extortion demand.

  00
• Cybersecurity09/24/2026@CyberDesk

  Scattered Lapsus$ Hunters Open a Leak Site to Extort Salesforce

  Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce

  

  Starts 10/03/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins88% CONFIDENCEOverall confidence: 88%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better364 days agoBleepingComputer's^[1][2][3] report dated 'October 3, 2025' says 'Today, they launched a new data leak site containing 39 companies' with an 'October 10 deadline'.

  The gang posted samples from 39 companies' stolen Salesforce data and told Salesforce to pay by 10 October or see about a billion records leaked.

  00