Financial Services Could Be Next in Line for ShinyHunters

Hackers have released stolen data belonging to US insurance giant Allianz Life, exposing 2.8 million records with sensitive information on business partners and customers in ongoing Salesforce data theft attacks. Last month, Allianz Life disclosed that it suffered a data breach when the personal information for the "majority" of its 1.4 million customers was stolen from a third-party, cloud-based CRM system on July 16th. While the company did not name the provider, BleepingComputer first reported the incident was part of a wave of Salesforce-targeted thefts carried out by the ShinyHunters extortion group. Over the weekend, ShinyHunters and other threat actors claiming overlap with "Scattered Spider" and "Lapsus$" created a Telegram channel called "ScatteredLapsuSp1d3rHunters" to taunt cybersecurity researchers, law enforcement, and journalists while taking credit for a string of high-profile breaches. Many of these attacks had not previously been attributed to any threat actor, including the attacks on Internet Archive, Pearson, and Coinbase. One of the attacks claimed by the threat actors is Allianz Life, for which they proceeded to leak the complete databases that were stolen from the company's Salesforce instances. These files consist of the Salesforce "Accounts" and "Contacts" database tables, containing approximately 2.8 million data records for individual customers and business partners, such as wealth management companies, brokers, and financial advisors. The leaked Salesforce data includes sensitive personal information, such as names, addresses, phone numbers, dates of birth, and Tax Identification Numbers, as well as professional details like licenses, firm affiliations, product approvals, and marketing classifications. BleepingComputer has been able to confirm with multiple people that their data in the leaked files is accurate, including their phone numbers, email addresses, tax IDs, and other information contained in the database. BleepingComputer contacted Allianz Life about the leaked database but was told that they could not comment as the investigation is ongoing. The Salesforce data-theft attacks The Salesforce data theft attacks are believed to have started at the beginning of the year, with the threat actors conducting social engineering attacks to trick employees into linking a malicious OAuth app with their company's Salesforce instances. Once linked, the threat actors used the connection to download and steal the databases, which were then used to extort the company through email. Extortion demands were sent to the companies via email and were signed as coming from ShinyHunters. This notorious extortion group has been linked to many high-profile attacks over the years, including those against AT&T, PowerSchool, and the SnowFlake attacks. While ShinyHunters is known to target cloud SaaS applications and website databases, they are not known for these types of social engineering attacks, causing many researchers and the media to attribute some of the Salesforce attacks to Scattered Spider. However, ShinyHunters told BleepingComputer the "ShinyHunters" group and "Scattered Spider" are now one and the same. "Like we have said repeatedly already, ShinyHunters and Scattered Spider are one and the same," ShinyHunters told BleepingComputer. "They provide us with initial access and we conduct the dump and exfiltration of the Salesforce CRM instances. Just like we did with Snowflake." It is also believed that many of the group's members share their roots in another hacking group known as Lapsus$, which was responsible for numerous attacks in 2022-2023, before some of their members were arrested. Lapsus$ was behind breaches at Rockstar Games, Uber, 2K, Okta, T-Mobile, Microsoft, Ubisoft, and NVIDIA. Like Scattered Spider, Lapsus$ was also adept at social engineering attacks and SIM swap attacks, allowing them to run over billion and trillion-dollar companies' IT defenses. Over the past couple of years, there have been many arrests linked to all three collectives, so it's not clear if the current threat actors are old threat actors, new ones who have picked up the mantle, or are simply utilizing these names to plant false flags. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

An ongoing data extortion campaign targeting Salesforce customers may soon turn its attention to financial services and technology service providers, as ShinyHunters and Scattered Spider appear to be working hand in hand, new findings show. "This latest wave of ShinyHunters-attributed attacks reveals a dramatic shift in tactics, moving beyond the group's previous credential theft and database exploitation," ReliaQuest said in a report shared with The Hacker News. These include the use of adoption of tactics that mirror those of Scattered Spider, such as highly-targeted vishing (aka voice phishing) and social engineering attacks, leveraging apps that masquerade as legitimate tools, employing Okta-themed phishing pages to trick victims into entering credentials during vishing, and VPN obfuscation for data exfiltration. ShinyHunters, which first emerged in 2020, is a financially motivated threat group that has orchestrated a series of data breaches targeting major corporations and monetizing them on cybercrime forums like RaidForums and BreachForums. Interestingly, the ShinyHunters persona has been a key participant in these platforms both as a contributor and administrator. "The ShinyHunters persona partnered with Baphomet to relaunch the second instance of BreachForums (v2) in June 2023 and later launched the June 2025 instance (v4) alone," Sophos noted in a recent report. "The interim version (v3) abruptly disappeared in April 2025, and the cause is unclear." While the relaunch of the forum was short-lived and the bulletin board went offline around June 9, the threat actor has since been linked to attacks targeting Salesforce instances globally, a cluster of extortion-related activity that Google is tracking under the moniker UNC6240. Coinciding with these developments was the arrest of four individuals suspected of running BreachForums, including ShinyHunters, by French law enforcement authorities. However, the threat actor told DataBreaches.Net that "France rushed to make FALSE, INACCURATE arrests," raising the possibility that an "associate" member may have been caught. And that's not all. On August 8, a new Telegram channel conflating ShinyHunters, Scattered Spider, and LAPSUS$ called "scattered lapsu$ hunters" emerged, with the channel members also claiming to be developing a ransomware-as-a-service solution called ShinySp1d3r that they said will rival LockBit and DragonForce. Three days later, the channel was banned and removed by Telegram. Both Scattered Spider and LAPSUS$ have ties to a broader, nebulous collective dubbed The Com, a notorious network of experienced English-speaking cybercriminals that's known to engage in a wide range of malicious activities, including SIM swapping, extortion, and physical crime. "Scattered LAPSUS$ Hunters represents a new phase in cyber extortion where clout and chaos are as much the objectives as money," FalconFeeds said. "Their connection to known entities like Scattered Spider and ShinyHunters indicates this is less a “new” group than a rebranding and coalescence of existing threat actors responding to recent law enforcement heat." ReliaQuest said it has identified a coordinated set of ticket-themed phishing domains and Salesforce credential harvesting pages that are likely created for similar campaigns targeting Salesforce that are aimed at high-profile companies across various industry verticals. These domains, the company said, were registered using infrastructure typically associated with phishing kits commonly used to host single sign-on (SSO) login pages -- a hallmark of Scattered Spider's attacks impersonating Okta sign-in pages. Furthermore, an analysis of over 700 domains registered in 2025 that matched Scattered Spider phishing patterns has revealed that domain registrations targeting financial companies have increased by 12% since July 2025, while targeting of technology firms has decreased by 5%, suggesting that banks, insurance companies and financial services could be next in line. The tactical overlaps aside, that the two groups may be collaborating is borne out by the fact that they have targeted the same sectors (i.e., retail, insurance, and aviation) around the same time. "Supporting this theory is evidence such as the appearance of a BreachForums' user with the alias 'Sp1d3rHunters,' who was linked to a past ShinyHunters breach, as well as overlapping domain registration patterns," researchers Kimberley Bromley and Ivan Righi said, adding the account was created in May 2024. "If these connections are legitimate, they suggest that collaboration or overlap between ShinyHunters and Scattered Spider may have been ongoing for more than a year. The synchronized timing and similar targeting of these previous attacks strongly support the likelihood of coordinated efforts between the two groups." Update The threat actor collective ShinyHunters has announced that BreachForums has been commandeered by international law enforcement agencies, and that the site has been turned into a honeypot. "The platform is currently being operated by French law enforcement agencies, including the BL2C, in coordination with the United States Department of Justice (DoJ) and the Federal Bureau of Investigation (FBI)," ShinyHunters claimed, adding the accounts "Hollow," "ShinyHunters" are compromised, and that the account "N/A" has been taken over by a federal agent. "Law enforcement never figured it out but I am here to confirm ShinyHunters alt accounts were Anastasia and Hollow. Anastasia and Hollow administrator accounts were always controlled by one person, me, ShinyHunters." ShinyHunters' alleged leader, Shiny, also had a word of caution: "If BreachForums remains online following this notice, it is operating as a honeypot under the control of multiple international law enforcement agencies. BreachForums will not be returning under legitimate operation. Any reappearance of the site should be regarded as a law enforcement trap."

Manpower, one of the world's largest staffing companies, is notifying nearly 145,000 individuals that their information was stolen by attackers who breached the company's systems in December 2024. Together with Experis and Talent Solutions, the company is part of ManpowerGroup, a multinational corporation with over 600,000 workers in more than 2,700 offices and serving over 100,000 clients worldwide. Last year, ManpowerGroup reported revenues of $17.9 billion and a total gross profit of $3.1 billion. According to a data breach filing with the Office of Maine's Attorney General this week, Manpower is now alerting 144,189 individuals who were impacted by a data breach after undisclosed attackers gained access to the company's systems in late December. The company detected the incident while investigating an IT systems outage at a Lansing, Michigan, franchise on January 20. "Through that investigation, we learned of information suggesting that an unknown actor gained unauthorized access to our network between December 29, 2024 and January 12, 2025 and potentially acquired certain files, some of which may have contained certain individuals' personal information," Manpower says in breach notification letters sent to affected individuals. "On or about July 28, 2025, Manpower of Lansing learned that your personal information may have been involved in connection with the incident which is the reason for this notification." After discovering the incident, the company states that it has strengthened its IT security to prevent future breaches and is now working with the FBI to hold the attackers accountable. Manpower is also offering those affected by this data breach free credit monitoring and identity theft protection services through Equifax. Attack claimed by RansomHub ransomware While the company has yet to attribute the attack to a specific threat actor or cybercrime group, the RansomHub ransomware operation claimed responsibility for the attack in January, after Manpower stated that it had discovered the breach. The ransomware gang claimed to have stolen approximately 500GB of data from Manpower's compromised systems, containing a wide range of client and corporate information. As the attackers said, the stolen files contained databases of clients, including personal and corporate data (passport scans, IDs, SSNs, addresses, contact information, test results, and other data), years of corporate correspondence, financial statements, HR data analytics, as well as confidential contracts and non-disclosure agreements. RansomHub has since removed the Manpower entry from its dark web leak site, suggesting that the company may have paid a ransom to have the data deleted. The RansomHub ransomware-as-a-service (RaaS) operation (previously known as Cyclops and Knight) surfaced in February 2024 and has since claimed many high-profile victims, including oil services giant Halliburton, the Rite Aid drugstore chain, Kawasaki's EU division, the Christie's auction house, US telecom provider Frontier Communications, the Planned Parenthood sexual health nonprofit, and the Bologna Football Club. This ransomware gang also leaked Change Healthcare's stolen data after the most significant healthcare breach in recent years, impacting over 190 million individuals, and the BlackCat/ALPHV ransomware operation's exit scam. One year ago, the FBI said RansomHub affiliates had breached over 200 critical infrastructure organizations in the United States as of August 2024. A ManpowerGroup spokesperson didn't provide more details when BleepingComputer reached out regarding the information exposed in the breach and RansomHub's claims, but stated that the incident didn't impact ManpowerGroup's corporate network. "Earlier this year we were made aware that an independently owned and operated Manpower franchise in Lansing was impacted by a ransomware attack. This franchise operates on an independent data platform, making this an isolated incident where no ManpowerGroup corporate systems were affected," the spokesperson told BleepingComputer. "All those impacted by the Lansing breach have been informed. ManpowerGroup is counseling the franchisee and supporting their efforts, while the franchisee manages the direct response." Update August 13, 07:14 EDT: Added ManpowerGroup statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

An ongoing data extortion campaign targeting Salesforce customers could soon turn its attention to financial services firms, security experts have warned. The notorious ShinyHunters group has been blamed for a series of data breaches impacting big names in the fashion (LVMH, Chanel, Pandora, Adidas) and aviation (Qantas, Air France-KLM) sectors. These victims are typically targeted with vishing for logins to their Salesforce accounts and are sometimes also tricked into downloading a malicious app for similar purposes. However, ReliaQuest said today that its analysis of phishing domain names used in the group’s attacks points to a shift in targets. “Since July 2025, domain registrations targeting financial companies have increased by 12%, while targeting of technology firms has decreased by 5%,” the threat intelligence firm said. “This shift suggests that financially motivated groups like ShinyHunters are now prioritizing banks, insurance companies and financial services, though technology and professional services remain at high risk due to the value of the data and access they provide.” Some 700 of these domains have been registered in 2025, indicating the scale of the campaign. Are ShinyHunters and Scattered Spider the Same? Additionally, many, such as “company-okta[.]com” and “companyname-my-salesforce[.]com” match the same format as those used by the infamous Scattered Spider collective, said ReliaQuest. Many also share the same registry details, suggesting the groups are connected. The theory is backed by the appearance last year on BreachForums of a user calling themselves “Sp1d3rhunters,” who has reportedly claimed the two groups “are the same.” Both have ties to a nebulous movement dubbed “The Com,” which is characterized by English speaking teens and young adults, usually male, who have also veered into violence for hire, sextortion and online child abuse. The key for corporate security teams keen to avoid becoming the next victim is to focus on tactics, techniques and procedures (TTPs) rather than which group may be doing the attacking, said ReliaQuest. “Threat actors constantly rotate infrastructure, change names, and adapt their TTPs to evade detection and maximize impact. As a result, tracking the behavioral patterns and evolving TTPs behind these campaigns is far more valuable than focusing solely on indicators of compromise (IOCs) or attribution,” it argued. “For security leaders, understanding this fluid and persistent threat landscape is critical to anticipating future attacks and making informed decisions about security strategy and resource allocation.”

Connex, one of Connecticut's largest credit unions, warned tens of thousands of members that unknown attackers had stolen their personal and financial information after breaching its systems in early June. Founded in 1940, this member-owned organization is a non-profit with over $1 billion in assets, providing banking, insurance, and credit card services to more than 70,000 members across eight branches throughout the greater New Haven area, including New Haven, Hartford, Middlesex, and Fairfield counties. In data breach notification letters sent to affected individuals via U.S. Mail and filed with the office of Maine's Attorney General, Connex states that it discovered the incident on June 3, one day after its network was breached. "The investigation revealed that certain files may have been accessed or downloaded without authorization between June 2 and 3, 2025," it said. "On July 27, 2025, Connex identified certain individuals whose personal information may have been involved in the incident." The non-profit has yet to find evidence that the attackers gained access to the affected members' funds or accounts, but has discovered that they stole a combination of personal and financial data, including names, account numbers, debit card information, Social Security numbers, and government IDs. While the breach notification letters don't mention anything about the stolen data being used in attacks, Connex now displays a scam alert on its official websites, cautioning members of scammers impersonating its employees in ongoing phishing attacks. "Please be aware that scammers are calling/texting members impersonating Connex employees. Connex will never call you and ask for PINs, passcodes, or account numbers," Connex warns. "If you receive a suspicious call or text, hang up and call us directly at 1-800-CR-UNION (203-603-5700)." The disclosure comes on the heels of a wave of data breaches linked to the ShinyHunters extortion group, which targets Salesforce instances in vishing and social engineering attacks, impacting many high-profile companies, including Allianz Life, Adidas, Qantas, Louis Vuitton, Dior, Tiffany & Co., Chanel, and Google. The insurance sector has also been targeted by attacks linked to the Scattered Spider hacker collective, which has shifted its focus to aviation firms and retail companies in recent months. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Google has confirmed that a recently disclosed data breach of one of its Salesforce CRM instances involved the information of potential Google Ads customers. "We're writing to let you know about an event that affected a limited set of data in one of Google's corporate Salesforce instances used to communicate with prospective Ads customers," reads a data breach notification shared with BleepingComputer. "Our records indicate basic business contact information and related notes were impacted by this event." Google says the exposed information includes business names, phone numbers, and "related notes" for a Google sales agent to contact them again. The company says that payment information was not exposed and that there is no impact on Ads data in Google Ads Account, Merchant Center, Google Analytics, and other Ads products. The breach was conducted by threat actors known as ShinyHunters, who have been behind an ongoing wave of data theft attacks targeting Salesforce customers. While Google has not shared how many individuals were impacted, ShinyHunters says the stolen information contains approximately 2.55 million data records. It is unclear if there are duplicates within these records. ShinyHunters further told BleepingComputer that they are also working with threat actors associated with "Scattered Spider, who are responsible for first gaining initial access to targeted systems. "Like we have said repeatedly already, ShinyHunters and Scattered Spider are one and the same," ShinyHunters told BleepingComputer. "They provide us with initial access and we conduct the dump and exfiltration of the Salesforce CRM instances. Just like we did with Snowflake." The threat actors are now referring to themselves as "Sp1d3rHunters," to illustrate the overlapping group of people who are involved in these attacks. As part of these attacks, the threat actors conduct social engineering attacks against employees to gain access to credentials or trick them into linking a malicious version of Salesforce's Data Loader OAuth app to the target's Salesforce environment. The threat actors then download the entire Salesforce database and extort the companies via email, threatening to release the stolen data if a ransom is not paid. These Salesforce attacks were first reported by the Google Threat Intelligence Group (GTIG) in June, with the company suffering the same fate a month later. Databreaches.net reported that the threat actors have already sent an extortion demand to Google. After publishing the story, ShinyHunters told BleepingComputer that they demanded 20 Bitcoins, or approximately $2.3 million, from Google to not leak the data. "I don't care about ransoming Google anyway, I just sent them a bogus email for the lulz of it," said the threat actor. ShinyHunters says they have since switched to a new custom tool that makes it easier and quicker to steal data from compromised Salesforce instances. In an update, Google recently acknowledged the new tooling, stating that they have seen Python scripts used in the attacks instead of the Salesforce Data Loader. Update 8/9/25: Added further information about the extortion demand. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

In recent months, headlines have been dominated by the cybercrime collective known as Scattered Spider, also referred to as UNC3944, Scattered Swine, Octo Tempest, Storm-0875, and Muddled Libra. This loosely but highly organized group has launched a wave of attacks targeting retailers, insurers, and, most recently, airlines across multiple countries. Although British authorities arrested four suspects in July 2025, which led to a noticeable slowdown in activity, this may only be temporary. Scattered Spider is not a monolithic, state-sponsored operation. Rather, it is a decentralized collective, often composed of teenagers and young men emerging from online communities. The group first made headlines in 2023 with high-profile attacks on casino giants like MGM Resorts. Despite the consistency and visibility of their tactics, many organizations have failed to adequately strengthen their defenses. This raises the question: why have so few taken decisive actions to counter these persistent threats? Inside the Scattered Spider Playbook Scattered Spider engages in data extortion and a variety of other criminal activities. Its threat actors are known to deploy multiple ransomware variants in their attacks, most recently including DragonForce ransomware. While the group frequently adapts its tactics, techniques, and procedures (TTPs) to remain undetected, several methods remain consistent. Common TTPs include the following: Initial Access: The group extensively uses social engineering tactics such as phishing, push bombing (spamming multi-factor authentication prompts), and SIM swap attacks to steal credentials, install remote access tools, and bypass multi-factor authentication (MFA). Attack Execution: Leveraging living-off-the-land techniques, the attackers use native Windows tools such as PowerShell, Rundll32, WMIC, and Task Scheduler. This helps them avoid detection by traditional antivirus and endpoint detection and response (EDR) systems. Persistence: Scattered Spider abuses identity providers such as Okta, Microsoft Entra, and Active Directory to create backdoor administrative accounts, modify authentication workflows, and inject custom SAML tokens. They frequently use remote access tools like AnyDesk™, TeamViewer®, ScreenConnect™, and Splashtop® to blend in with legitimate IT activity. Privilege Escalation: The attackers enumerate internal accounts and groups, using built-in commands. They also exploit cloud privileges, such as roles in AWS or GCP, to escalate access and expand their footprint. Internal Reconnaissance: As with many advanced adversaries, the group maps out network topology to identify high-value systems such as domain controllers, file shares, and backup servers. They also extract sensitive data and credentials from platforms like Confluence, Jira, Slack, and SharePoint. Impact and Extortion: Scattered Spider often partners with ransomware groups such as ALPHV/BlackCat or RansomHub to encrypt data and issue ransom demands, typically requesting cryptocurrency. The group follows the broader trend of double or triple extortion, threatening to leak stolen data, contact regulators or customers, or launch follow-up attacks if demands are not met. The Help Desk Blind Spot One of Scattered Spider’s most effective and recognizable tactics involves impersonating IT help desk personnel via phone calls or text messages to obtain credentials or persuade employees to install remote access software. More recently, the group has reversed roles, now posing as employees to deceive IT or help desk staff into revealing sensitive information, resetting passwords, and transferring MFA tokens to attacker-controlled devices. In doing so, the attackers are exploiting a significant security oversight: IT help desks are often viewed as internal and inherently trustworthy, and as a result, are frequently excluded from multi-layered cybersecurity strategies. This is a critical blind spot that organizations must address immediately. How to Minimize Risk Exposure To reduce risks associated with Scattered Spider’s tactics, organizations should implement the following measures: Implement application controls, including white-listing for remote access tools Require phishing-resistant MFA such as FIDO2 or PKI-based authentication Restrict the use of Remote Desktop Protocol (RDP) and other remote access tools Develop and evaluate a robust business continuity plan, and maintain offline backups Enforce NIST-compliant password policies across all accounts Regularly patch and update all operating systems, applications, and firmware Restrict administrative privileges and use just-in-time access where possible To address the specific help desk vulnerability, organizations should introduce multi-step identity verification for all password resets and access recovery requests. Identity proofing and continuous verification are now essential components of any modern cybersecurity framework. They protect against identity-based threats, support compliance efforts, improve user experience, and strengthen organizational trust. Conclusion Scattered Spider and similar cybercriminal groups continue to represent a persistent and evolving threat. To stay ahead, organizations must implement holistic security strategies that cover all areas of their operations, including IT help desks. These often-overlooked teams have become prime targets. In a threat landscape increasingly shaped by social engineering and ransomware, proactive defense, layered protection, and closing internal security gaps are not optional; they are essential.

Google has confirmed that it is among the victims of an ongoing data theft campaign targeting Salesforce instances. The tech giant confirmed that data has been retrieved by the threat actor, however this was largely publicly available business information, such as business names and contact details. The cyber-attack has been linked to ShinyHunters, tracked by the Google Threat Intelligence Group (GTIG) as UNC6040 and UN6240. In a blog update published on August 5, Google said, “Google responded to the activity, performed an impact analysis and began mitigations. The instance was used to store contact information and related notes for small and medium businesses.” ShinyHunters is a financially motivated threat cluster that specializes in voice phishing (vishing) campaigns specifically designed to compromise organizations' Salesforce instances for large-scale data theft and subsequent extortion. The vishing campaigns aim to trick victims into handing over login details and MFA codes. ShinyHunters Preparing for Escalation GTIG has warned that the threat actors using the ShinyHunters brand may be preparing to escalate their extortion tactics by launching a data leak site. At the moment, their extortion tactics involve calls or emails to employees of the victim organization demanding payment in bitcoin within 72 hours. A new leak site will increase pressure on victims, including those impacted by recent Salesforce-related data breaches. William Wright, CEO of Closed Door Security, commented, “ShinyHunters has recently executed a huge volume of attacks via Salesforce and it is essential organizations take note of these. The threat actors have also claimed many attacks are still unreported, so we can expect more victims to be announced in coming weeks.” Chanel and Pandora disclosed breaches of customer data linked to the ShinyHunters activity in early August 2025. Other companies suspected to have been victimized in a similar way by ShinyHunters include Allianz Life, Adidas, Qantas and several LVMH brands. Image credit: bluestork / Shutterstock.com

Air France and KLM are notifying some customers that their personal information may have been obtained by hackers following unauthorized access to a third-party platform used by the airlines. According to the companies, the unnamed platform is used for customer service and the hackers gained access to data such as first and last name, contact details, service request email subject lines, and Flying Blue loyalty program numbers. More sensitive information such as passwords, passports, credit card information, travel details, or Flying Blue miles has not been compromised. However, the airlines have warned customers to be on the lookout for email and phone phishing attempts. KLM is based in the Netherlands and Air France is based in France, but they are part of the same airline group. The companies have reported the incident to the data protection authorities in their respective countries. While no additional details have been provided by KLM and Air France, it’s worth noting that several major companies reported recently that hackers obtained their data after breaching a third-party customer relationship management (CRM) system. According to Bleeping Computer, the attacks all seem to be part of a campaign targeting Salesforce instances. A hacker group named ShinyHunters claims to be behind the attacks, and some links have also been found to the Scattered Spider cybercrime group. According to some reports, the two groups may have merged. The cybersecurity community recently warned airlines that Scattered Spider had started targeting this sector. The Salesforce attacks do not involve exploitation of any vulnerability or access to the vendor’s systems. Instead, the hackers are using phishing and social engineering to gain access to targeted instances. The list of major companies that appear to have been hit by the campaign includes Google, Adidas, Allianz Life, Cisco, Dior and Louis Vuitton. Related: Over 1 Million Impacted by DaVita Data Breach Related: Cost of Data Breach in US Rises to $10.22 Million, Says Latest IBM Report Related: Tea App Takes Messaging System Offline After Second Security Issue Reported

At the heart of multiple data breaches against sophisticated and robust companies, including Google, Adidas, Louis Vuitton, and Chanel, was a rudimentary attack method that required little technical finesse—making a phone call. By disguising themselves as IT support personnel on the phone, hackers belonging to the group “ShinyHunters” successfully tricked the employees at several multinational corporations into handing over the data within their own Salesforce platforms. The attacks underscore the vulnerability that all businesses face—large or small—in preventing cyberattacks that begin through basic social engineering scams. In a bizarre twist of irony, security researchers at Google Threat Intelligence Group (GITG) originally uncovered the hacking campaign in June, only to announce that Google itself had been hit by the very same tactic this week. Other victims in the hacking campaign include Allianz Life, the airline Qantas, and the jeweler Pandora. The data breaches all leverage a Salesforce feature that allows users to connect to various, external apps. This functionality allows business owners and employees to, for instance, connect their Salesforce data to mapping tools to visualize the locations of a customer base, or to connect their Salesforce data with a newsletter platform to deliver email marketing campaigns to specific customer segments. In the attacks, the hackers trick employees into connecting to a fraudulent version of Salesforce’s “Data Loader” app, which lets users import, export, update, and delete large quantities of data that are stored or managed within Salesforce itself. The process for connecting to an external app is simple, as employees just enter an 8-digit code when prompted by Salesforce. But once ensnared in the phone scam, employees are tricked into entering an 8-digit code that will connect to a data exfiltration program owned and operated entirely by the hackers. Once connected, the hackers are free to roam inside the company’s Salesforce data and steal what they see fit. Some attacks reportedly included an expansion by the hackers into other corporate online accounts, including Microsoft 365, which could reveal a company’s emails and other sensitive messages. In the attack against Google, the hackers accessed a Salesforce “instance,” which is a term used to describe a company or user’s implementation of software and the data they manage through that software (Think of it like when a hacker breaches an online account and then pilfers all the data related to that account and what it can access). In the Google attack, the Salesforce instance “was used to store contact information and related notes for small and medium businesses.” “Analysis revealed that data was retrieved by the threat actor during a small window of time before the access was cut off,” Google said. “The data retrieved by the threat actor was confined to basic and largely publicly available business information, such as business names and contact details.” According to the outlet Bleeping Computer, the ShinyHunters cybercrime group is still stealing business data through this attack campaign. Once the hackers have the data, they then extort the victims to pay a hefty ransom or risk having the data exposed online. How to stay safe from the Salesforce scam Because this attack is so targeted—every corporate victim uses Salesforce—the defense strategies are clear and actionable. Here’s how you can help yourself and your staff in avoiding this attack. Audit your Salesforce access. Ensure that the only employees or staff who have access to Salesforce are those who need to use it for their job. When there are fewer employees who can access Salesforce, there are fewer entry points for hackers. Train your staff. Recognizing a social engineering scam is important for any workforce, no matter the size. Inform your employees and yourself about your current IT support provider so that any rogue phone calls are immediately caught. Use multifactor authentication (MFA) for important accounts. The hackers in these attacks managed to gain access to other cloud applications like Microsoft 365. Protect all your employee accounts on sensitive platforms with MFA. Social engineering scams are some of the most effective and serious threats to small businesses. It’s important to recognize them when they happen. And for all else, use always-on cybersecurity to protect your business from malware, viruses, and nefarious break-in attempts.

Google revealed on Tuesday that one of its corporate Salesforce instances was targeted by threat actors. The attack appears to be part of a campaign that has hit several major companies. The tech giant said its Salesforce instance was targeted in June and attributed the activity to a threat group tracked as UNC6040. Google said the hackers obtained contact information and related notes for small and medium businesses from the compromised environment. “Analysis revealed that data was retrieved by the threat actor during a small window of time before the access was cut off,” Google explained. “The data retrieved by the threat actor was confined to basic and largely publicly available business information, such as business names and contact details.” Google warned in early June that UNC6040, a threat actor specializing in voice phishing, had targeted Salesforce customers in a large-scale data theft and extortion campaign. Google reported at the time that it had found links to the notorious cybercrime groups Scattered Spider and ShinyHunters. The attack on its own Salesforce instance was disclosed in an update to the blog post describing the UNC6040 attacks, and the company has now reiterated the apparent link to ShinyHunters. According to the tech giant, UNC6040 is responsible for the initial intrusion, while a different activity cluster, tracked as UNC6240, is responsible for extortion attempts, which sometimes are initiated months after the initial data theft. “The extortion involves calls or emails to employees of the victim organization demanding payment in bitcoin within 72 hours. During these communications, UNC6240 has consistently claimed to be the threat group ShinyHunters,” Google said. “In addition, we believe threat actors using the ‘ShinyHunters’ brand may be preparing to escalate their extortion tactics by launching a data leak site (DLS). These new tactics are likely intended to increase pressure on victims, including those associated with the recent UNC6040 Salesforce-related data breaches,” it added. Bleeping Computer reported — based on information from ShinyHunters — that the recent data breaches disclosed by Adidas, Allianz Life, Cisco, Dior, Louis Vuitton and others are the result of the same Salesforce hacking campaign. Jewelry store Pandora also disclosed a data breach this week and the company was reportedly a target of the same campaign. Salesforce pointed out that its systems have not been compromised and the attacks do not exploit any vulnerability in its platform. The company suggested that the recent attacks are the result of sophisticated phishing and other social engineering attacks targeting its customers. DataBreaches reported recently that ShinyHunters appears to have merged with Scattered Spider. Several alleged members of both ShinyHunters and Scattered Spider have been arrested over the past year. Related: Over 1 Million Impacted by DaVita Data Breach Related: NASCAR Confirms Personal Information Stolen in Ransomware Attack

Google is the latest company to suffer a data breach in an ongoing wave of Salesforce CRM data theft attacks conducted by the ShinyHunters extortion group. In June, Google warned that a threat actor they classify as 'UNC6040' is targeting companies' employees in voice phishing (vishing) social engineering attacks to breach Salesforce instances and download customer data. This data is then used to extort companies into paying a ransom to prevent the data from being leaked. In a brief update to the article last night, Google said that it too fell victim to the same attack in June after one of its Salesforce CRM instances was breached and customer data was stolen. "In June, one of Google's corporate Salesforce instances was impacted by similar UNC6040 activity described in this post. Google responded to the activity, performed an impact analysis and began mitigations," reads Google's update. "The instance was used to store contact information and related notes for small and medium businesses. Analysis revealed that data was retrieved by the threat actor during a small window of time before the access was cut off." "The data retrieved by the threat actor was confined to basic and largely publicly available business information, such as business names and contact details." Google is classifying the threat actors behind these attacks as 'UNC6040' or 'UNC6240.' However, BleepingComputer, which has been tracking these attacks, has learned that a notorious threat actor known as ShinyHunters is behind the attacks. ShinyHunters has been around for years, responsible for a wide range of breaches, including those at PowerSchool, Oracle Cloud, the Snowflake data-theft attacks, AT&T, NitroPDF, Wattpad, MathWay, and many more. In a conversation with BleepingComputer yesterday, ShinyHunters claimed to have breached many Salesforce instances, with attacks still ongoing. The threat actor claimed yesterday to BleepingComputer that they breached a trillion-dollar company, and were considering just leaking the data rather than attempting to extort them. It is unclear if this company is Google. As for the other companies impacted in these attacks, the threat actor is extorting them through email, demanding they pay a ransom to prevent the data from being publicly leaked. Once the threat actor has finished privately extorting companies, they plan to publicly leak or sell data on a hacking forum. BleepingComputer has learned of one company that has already paid 4 Bitcoins, or approximately $400,000, to prevent the leak of their data. Other companies impacted in these attacks include Adidas, Qantas, Allianz Life, Cisco, and the LVMH subsidiaries Louis Vuitton, Dior, and Tiffany & Co. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Chanel and Pandora have become the latest fashion giants to disclose breaches of customer data, in what appear to be attacks on their Salesforce accounts. Danish jewelry retailer Pandora began notifying customers of the incident this week, according to screenshots posted to Reddit. “We are writing to inform you that your contact information was accessed by an unauthorized party through a third-party platform we use,” the notice read. “We stopped the access and have further strengthened our security measures.” According to the message, only names, birthdates and emails were impacted, with no financial data or passwords stolen. However, this still represents a potentially major security risk for customers, according to Mark Weir, regional director of UK and Ireland at Check Point Software. “This breach may involve only names, emails and birthdates, but that’s enough for phishing, credential stuffing and synthetic identity fraud. In cyber terms, this is a strong starting point for more serious attacks,” he warned. “The attack came via a third-party platform – a common weak link in retail ecosystems. These integrations often lack visibility, yet when they’re breached, there’s no guarantee all affected customers will be told.” Separately, Chanel informed its US customers of an incident it discovered on July 25, according to screenshots posted on X (formerly Twitter). “Chanel became aware of a security incident involving a Chanel, Inc. database in the US hosted by a third-party service provider, where an unauthorized external party accessed and obtained some of the client data we hold,” it revealed. “There was no malware deployed to our systems, and our operations remain unaffected.” This time, the breach involved names, email and home addresses, and phone numbers. ShinyHunters the Prime Suspect Although the firms have yet to reveal any further details, suspicion is mounting that the attacks could be part of an ongoing data extortion campaign by the ShinyHunters (UNC6040) group. This was first flagged in June by Google Threat Intelligence, which revealed that the actors use voice phishing (vishing) techniques to trick employees into believing they are calling from IT. The actors then persuade the victims into handing over their Salesforce credentials and MFA tokens, or adding a malicious version of Salesforce’s Data Loader app, to gain access to their customer database. In an update yesterday, Google said the group has now shifted to using Python scripts that perform a similar function to the Data Loader app, as well as TOR IPs to obfuscate their location. Google added that the group, which has been linked to Scattered Spider/The Com, “may be preparing to escalate their extortion tactics by launching a data leak site.” The tech giant also revealed that one of its own Salesforce instances had been breached by UNC6040 “for a small window of time.” It claimed that the exfiltrated data “was confined to basic and largely publicly available business information, such as business names and contact details.” Other companies suspected to have been victimized in a similar way by ShinyHunters include Allianz Life, Adidas, Qantas and several LVMH brands. “It is now evident that every company with a Salesforce/CRM presence is a potential target, and threat actors use highly convincing phone and email lures, and do not rely on technical exploits – making staff the primary attack vector,” argued ColorTokens chief evangelist, Agnidipta Sarkar. “In my opinion, apart from building awareness of outsourced helpdesks and support staff, cybersecurity leaders should immediately invest in technologies to reduce lateral movement, heavily restrict which employees can install or approve new Salesforce apps, use strict RBAC [role-based access] controls and microsegment cloud instances, enforce digital certificate-based passwordless authentication and continuously monitor the critical digital assets for anomalous and malicious behavior.” Image credit: Creative Lab / Shutterstock.com