ShinyHunters: upcoming dates

Recent

• Cybersecurity09/24/2026@CyberDesk

  Oracle Issues Emergency Fix for PeopleSoft Zero-Day Hit by ShinyHunters

  2300, Oracle Way, Lakeshore, Austin, Travis County, Texas, 78741, United StatesOracle

  

  Starts 06/10/2026CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins88% CONFIDENCEOverall confidence: 88%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better114 days agoOracle's^[1] Security Alert Advisory CVE-2026-35273 lists '2026-June-10 Rev 1. Initial Release' in its modification history.

  Oracle's Security Alert for CVE-2026-35273, a 9.8-rated no-login remote code execution flaw in PeopleSoft PeopleTools, came as ShinyHunters stole data from over 100 organizations, mostly universities.

  00
• Cybersecurity09/24/2026@CyberDesk

  Salesforce Warns of Mass Theft From Misconfigured Experience Cloud Sites

  Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce

  

  Starts 03/07/2026 10:48PM UTCCONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins85% CONFIDENCEOverall confidence: 85%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better209 days agoSalesforce^[1] Security's post is dated 'March 7, 2026' (published 22:48 UTC); FINRA^[2]: 'On March 7, 2026, Salesforce reported that ShinyHunters was actively exploiting misconfigured Experience Cloud guest user profiles.'

  Salesforce said a known threat group was mass-scanning public Experience Cloud sites with a modified Mandiant tool and pulling CRM data through overly permissive guest user profiles.

  00
• Cybersecurity09/24/2026@CyberDesk

  Salesforce Cuts Off Gainsight Apps After Suspicious Access to Customer Data

  350, Bay Street, Fisherman's Wharf, North Beach, San Francisco, California, 94133, United StatesGainsight

  

  Starts 11/19/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins88% CONFIDENCEOverall confidence: 88%How well the pin's source and references back up its dates.Weighted average of how firmly 6 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better317 days agoGainsight's^[1][3][4] incident timeline (PST): 'November 19, 2025 - Afternoon Salesforce notifies Gainsight of unusual activity involving the Gainsight Salesforce Connected App'; The Register^[5] says Salesforce announced the revocation on Wednesday, 19 November.

  Salesforce revoked every token held by Gainsight-published apps and pulled them from the AppExchange after spotting API calls from unrecognised IPs into customers' Salesforce data.

  00
• Cybersecurity09/24/2026@CyberDesk

  Hackers Dump Qantas and Vietnam Airlines Data After Salesforce Deadline

  Qantas Group Headquarters, 10, Bourke Road, Mascot, Sydney, New South Wales, 2020, AustraliaQantas

  

  Starts 10/11/2025 3:30AM UTCCONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins87% CONFIDENCEOverall confidence: 87%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better356 days agoInformation Age: 'The data was first leaked to a clear-web hacking forum at approximately 2.30pm AEDT Saturday' (11 October 2025), about an hour before it went up free on the dark web.^[1]

  When the ransom deadline passed, Scattered Lapsus$ Hunters published stolen Salesforce data of six companies, including 5 million Qantas customer records and 7.3 million Vietnam Airlines email addresses.

  00
• Cybersecurity09/24/2026@CyberDesk

  Salesforce Tells Customers It Won't Pay the Scattered Lapsus$ Hunters Ransom

  Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce

  

  Starts 10/07/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins86% CONFIDENCEOverall confidence: 86%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better360 days agoBleepingComputer^[1][4], 7 October 2025: 'Salesforce emailed customers on Tuesday to say they would not be paying a ransom' - Tuesday was 7 October.

  With the gang's leak deadline three days away, Salesforce emailed customers that it would not engage, negotiate with or pay any extortion demand.

  00
• Cybersecurity09/24/2026@CyberDesk

  Scattered Lapsus$ Hunters Open a Leak Site to Extort Salesforce

  Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce

  

  Starts 10/03/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins88% CONFIDENCEOverall confidence: 88%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better364 days agoBleepingComputer's^[1][2][3] report dated 'October 3, 2025' says 'Today, they launched a new data leak site containing 39 companies' with an 'October 10 deadline'.

  The gang posted samples from 39 companies' stolen Salesforce data and told Salesforce to pay by 10 October or see about a billion records leaked.

  00
• Cybersecurity09/24/2026@CyberDesk

  FBI Flash Warns UNC6040 and UNC6395 Are Raiding Salesforce Instances

  J. Edgar Hoover Building, 935, Pennsylvania Avenue Northwest, Penn Quarter, Ward 2, Washington, District of Columbia, 20535, United StatesFederal Bureau of Investigation

  

  Starts 09/12/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins89% CONFIDENCEOverall confidence: 89%How well the pin's source and references back up its dates.Weighted average of how firmly 3 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better1.1 years agoThe FBI's TLP:CLEAR alert is headed '12 September 2025' with FLASH number 'FLASH-20250912-001'.^[1]

  The FBI published indicators for two crews stealing companies' Salesforce data, one by phoning staff posing as IT support, the other with stolen Salesloft Drift tokens.

  00
• Law09/24/2026@LawDesk

  First Class Action Sues Salesforce Over the 2025 Customer Data Thefts

  Phillip Burton Federal Building & United States Courthouse, 450, Golden Gate Avenue, Civic Center, San Francisco, California, 94102, United StatesSalesforce

  

  Starts 08/27/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins89% CONFIDENCEOverall confidence: 89%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better1.1 years agoThe complaint in Scott v. Salesforce, Inc., No. 3:25-cv-07232, is stamped 'Filed 08/27/25', and the CourtListener^[1][2][3] docket lists it as entry 1 on 27 August 2025.

  A Farmers Insurance customer sued Salesforce in San Francisco federal court, calling it the 'hub' of a breach that exposed the data of its corporate clients' customers.

  00
• Cybersecurity09/24/2026@CyberDesk

  Hackers Use Stolen Salesloft Drift Tokens to Raid Salesforce Instances

  Atlanta, Fulton County, Georgia, United StatesSalesloft

  

  08/08/2025 - 08/18/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins87% CONFIDENCEOverall confidence: 87%How well the pin's source and references back up its dates.Weighted average of how firmly 5 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better1.2 years agoGTIG: 'Beginning as early as Aug. 8, 2025 through at least Aug. 18, 2025, the actor targeted Salesforce customer instances through compromised OAuth tokens associated with the Salesloft^[2] Drift third-party application.'

  Using OAuth tokens stolen from Salesloft's Drift chatbot, the UNC6395 crew exported data from hundreds of companies' Salesforce instances, hunting support cases for AWS keys, passwords and Snowflake tokens.

  00
• Cybersecurity09/24/2026@CyberDesk

  Google Exposes UNC6040's Vishing Raids on Salesforce Customers

  Salesforce Tower, 415, Mission Street, Rincon Hill, San Francisco, California, 94105, United StatesSalesforce

  

  Starts 06/04/2025CONFIRMEDDate confidence: CONFIRMEDStated as firmHow firmly the source words the date: confirmed, scheduled, estimated, delayed or unverified.Show all CONFIRMED pins88% CONFIDENCEOverall confidence: 88%How well the pin's source and references back up its dates.Weighted average of how firmly 4 references, the source included, support the pin's start and end times; a reference counts half as much for every 180 days older than the newestShow all pins at 75% confidence or better1.3 years agoThe Google^[1] Cloud Threat Intelligence post 'The Cost of a Call: From Voice Phishing to Data Extortion' is dated 'June 4, 2025'.

  Google's threat researchers said a crew posing as IT support on the phone was talking employees into approving a fake Data Loader app, then bulk-stealing their companies' Salesforce data for extortion.

  00