A sprawling coalition of hackers styling themselves as Scattered LAPSUS$ Hunters has claimed responsibility for one of the largest alleged data thefts in recent years, asserting that nearly one billion records have been siphoned from companies relying on Salesforce, the dominant US cloud software provider.
The group’s revelation, paired with the launch of a dark-web extortion portal, takes aim at multinational corporations and financial institutions that depend heavily on Salesforce to run customer operations.
Salesforce, which provides cloud-based customer relationship management tools to retailers, banks, insurers and wealth managers, has rejected the suggestion that its own platform was breached.
“At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology,” a company spokesperson told TechCrunch.
The self-branded “hunters” are linked to familiar names in cybercrime – ShinyHunters, Scattered Spider and the remnants of the Lapsus$ collective. Security analysts say the group has shifted away from traditional ransomware and toward public extortion: rather than encrypting systems, they threaten to release data unless companies comply with ransom demands.
The attackers’ tactics rely less on exploiting coding flaws and more on human manipulation. In recent months, researchers say, the hackers used “vishing” – voice-based phishing calls – convincing employees to provide access credentials or authorize rogue applications.
In some cases, investigators at Google’s Threat Intelligence Group observed employees tricked into downloading a doctored version of Salesforce’s own Data Loader, a tool designed for bulk data imports.
The dark-web portal created by the group lists dozens of household names, from Allianz Life – which disclosed a breach affecting nearly 1.5 million persons to the Office of the Maine Attorney General this week – to Google, Qantas, Toyota and Workday.
Extortion notices reviewed by multiple cybersecurity outlets cite companies across sectors – retail, airlines, automotive, finance – underscoring the reach of the campaign.
Brands from FedEx and Home Depot to McDonald’s, Marriott, Cartier, and Disney’s Hulu unit also appear on the site, though several have declined public comment.
Within the wealth space, Salesforce's reach through its Salesforce Financial Services Cloud and Salesforce Sales Cloud systems accounted for just over 10% of market share among advisors in the CRM space, according to the most recent T3 Advisortech survey this year.
The hackers claim to hold personal and corporate records numbering in the billions. Samples of data tied to at least 39 enterprises have been released, with the threat of full disclosure if no settlement is reached by October 10.
In a post aimed directly at Salesforce, the group demanded payment to halt publication of client data, warning that otherwise “all your customers data will be leaked.”
Beyond the immediate ransom threats, the hackers have suggested they may assist in legal action against Salesforce itself, citing obligations under Europe’s General Data Protection Regulation.
“Your organisation can prevent the release of this data, regain control over the situation and all operations remain stable as always,” the group wrote in one notice, while hinting that noncompliance could lead to civil exposure for Salesforce.
For financial services providers – particularly US wealth managers and insurers that have adopted Salesforce Financial Services Cloud or overlays such as Practifi and Salentica – the stakes are acute.
Firms like RBC Wealth Management, US Bank, and Pacific Life have publicly described using Salesforce to centralize client data, meaning a breach of customer instances could spill sensitive investment and planning information into criminal hands.
Compounding unease, Salesforce only days earlier disclosed a separate issue: a flaw dubbed “ForcedLeak” in its Agentforce AI platform. That bug, now patched, could have allowed attackers to exfiltrate CRM data through maliciously crafted inputs.
Though unrelated to the current extortion campaign, the incident highlights the widening attack surface as financial firms increasingly experiment with AI agents layered atop their CRM systems.
The J.C. Flowers-backed investor’s latest RIA deal adds five next-gen leaders to the Massachusetts firm’s ownership ranks
Meanwhile, UBS and Raymond James talk recruiting.
Elderly clients lost about 70% after a South Carolina advisor held inverse ETFs for 798 days on average, the regulator says
The new chat feature is expected to launch in 2027.
Vanguard finds auto portability curbs cash-outs, while PensionBee data show most automatic rollover IRAs lose value within a year
Knighthead Life entered the market with a competitive MYGA. A strong launch earned advisor confidence and paved the way for FIAs.
As AI makes financial information more accessible than ever, Lana Hock explains why human judgment, trust, and empathy remain the qualities clients value most in a financial advisor
