Workday Reveals CRM Breach

An ongoing data extortion campaign targeting Salesforce customers may soon turn its attention to financial services and technology service providers, as ShinyHunters and Scattered Spider appear to be working hand in hand, new findings show. "This latest wave of ShinyHunters-attributed attacks reveals a dramatic shift in tactics, moving beyond the group's previous credential theft and database exploitation," ReliaQuest said in a report shared with The Hacker News. These include the use of adoption of tactics that mirror those of Scattered Spider, such as highly-targeted vishing (aka voice phishing) and social engineering attacks, leveraging apps that masquerade as legitimate tools, employing Okta-themed phishing pages to trick victims into entering credentials during vishing, and VPN obfuscation for data exfiltration. ShinyHunters, which first emerged in 2020, is a financially motivated threat group that has orchestrated a series of data breaches targeting major corporations and monetizing them on cybercrime forums like RaidForums and BreachForums. Interestingly, the ShinyHunters persona has been a key participant in these platforms both as a contributor and administrator. "The ShinyHunters persona partnered with Baphomet to relaunch the second instance of BreachForums (v2) in June 2023 and later launched the June 2025 instance (v4) alone," Sophos noted in a recent report. "The interim version (v3) abruptly disappeared in April 2025, and the cause is unclear." While the relaunch of the forum was short-lived and the bulletin board went offline around June 9, the threat actor has since been linked to attacks targeting Salesforce instances globally, a cluster of extortion-related activity that Google is tracking under the moniker UNC6240. Coinciding with these developments was the arrest of four individuals suspected of running BreachForums, including ShinyHunters, by French law enforcement authorities. However, the threat actor told DataBreaches.Net that "France rushed to make FALSE, INACCURATE arrests," raising the possibility that an "associate" member may have been caught. And that's not all. On August 8, a new Telegram channel conflating ShinyHunters, Scattered Spider, and LAPSUS$ called "scattered lapsu$ hunters" emerged, with the channel members also claiming to be developing a ransomware-as-a-service solution called ShinySp1d3r that they said will rival LockBit and DragonForce. Three days later, the channel was banned and removed by Telegram. Both Scattered Spider and LAPSUS$ have ties to a broader, nebulous collective dubbed The Com, a notorious network of experienced English-speaking cybercriminals that's known to engage in a wide range of malicious activities, including SIM swapping, extortion, and physical crime. "Scattered LAPSUS$ Hunters represents a new phase in cyber extortion where clout and chaos are as much the objectives as money," FalconFeeds said. "Their connection to known entities like Scattered Spider and ShinyHunters indicates this is less a “new” group than a rebranding and coalescence of existing threat actors responding to recent law enforcement heat." ReliaQuest said it has identified a coordinated set of ticket-themed phishing domains and Salesforce credential harvesting pages that are likely created for similar campaigns targeting Salesforce that are aimed at high-profile companies across various industry verticals. These domains, the company said, were registered using infrastructure typically associated with phishing kits commonly used to host single sign-on (SSO) login pages -- a hallmark of Scattered Spider's attacks impersonating Okta sign-in pages. Furthermore, an analysis of over 700 domains registered in 2025 that matched Scattered Spider phishing patterns has revealed that domain registrations targeting financial companies have increased by 12% since July 2025, while targeting of technology firms has decreased by 5%, suggesting that banks, insurance companies and financial services could be next in line. The tactical overlaps aside, that the two groups may be collaborating is borne out by the fact that they have targeted the same sectors (i.e., retail, insurance, and aviation) around the same time. "Supporting this theory is evidence such as the appearance of a BreachForums' user with the alias 'Sp1d3rHunters,' who was linked to a past ShinyHunters breach, as well as overlapping domain registration patterns," researchers Kimberley Bromley and Ivan Righi said, adding the account was created in May 2024. "If these connections are legitimate, they suggest that collaboration or overlap between ShinyHunters and Scattered Spider may have been ongoing for more than a year. The synchronized timing and similar targeting of these previous attacks strongly support the likelihood of coordinated efforts between the two groups." Update The threat actor collective ShinyHunters has announced that BreachForums has been commandeered by international law enforcement agencies, and that the site has been turned into a honeypot. "The platform is currently being operated by French law enforcement agencies, including the BL2C, in coordination with the United States Department of Justice (DoJ) and the Federal Bureau of Investigation (FBI)," ShinyHunters claimed, adding the accounts "Hollow," "ShinyHunters" are compromised, and that the account "N/A" has been taken over by a federal agent. "Law enforcement never figured it out but I am here to confirm ShinyHunters alt accounts were Anastasia and Hollow. Anastasia and Hollow administrator accounts were always controlled by one person, me, ShinyHunters." ShinyHunters' alleged leader, Shiny, also had a word of caution: "If BreachForums remains online following this notice, it is operating as a honeypot under the control of multiple international law enforcement agencies. BreachForums will not be returning under legitimate operation. Any reappearance of the site should be regarded as a law enforcement trap."

The notorious Scattered Spider group seems to have been rattled and its cybercriminal activity stalled following the arrest of four individuals linked to the group and suspected of orchestrating cyber-attacks. The arrests took place in the UK on July 10, with the four individuals suspected of Computer Misuse Act offences relating to cyber-attacks on three British retailers in April 2025. They were later bailed pending further enquiries. Since then, cybersecurity firm Mandiant, which tracks The Com-affiliated group as UNC3944, said it has not observed any new intrusions directly attributable to this specific threat actor. The Com is a loosely organized online criminal network involving thousands of English-speaking individuals. Commenting on the four individuals arrested, Charles Carmakal, CTO, Mandiant Consulting – Google Cloud, told Infosecurity, “They aren't the only members who are involved in Scattered Spider intrusions. But the arrests have spooked other members.” Anthony Freed, director of research at ransomware prevention firm Halcyon, concurred that since the arrests Scattered Spider activity has “gone quiet.” He noted that the last confirmed attack linked to UNC3944 hit in May 2025 when Darktrace observed the group’s hallmark social engineering tactics in action. Since then, several airlines, including Hawaiian Airlines in late June and WestJet in mid-June, were targeted with some suspecting links to Scattered Spider due to familiar tradecraft. These events have not been definitively attributed to Scattered Spider. “That said, the Scattered Spider threat has not diminished, it is likely they are being more cautious in light of the arrests,” Freed said. Christiaan Beek, senior director, threat analytics at Rapid7, told Infosecurity that the firm’s researchers had observed some aggressive phishing email and social engineering campaigns in the past two weeks. However, Beek said it was too early to determine if these were linked to Scattered Spider. Other Threat Actors Persist with Similar Tradecraft Other groups, like ShinyHunters (UNC6040), also affiliated to The Com, employ the same type of social engineering tactics as Scattered Spider, such as targeting IT help desks to gain initial access. “While one group may be temporarily dormant, others won't relent," said Carmakal. In June 2025, the Google Threat Intelligence Group (GTIG) highlighted ShinyHunters’ specialist vishing campaigns designed to compromise organizations' Salesforce instances for large-scale data theft and subsequent extortion. In recent months, the group has demonstrated repeated success in impersonating IT support personnel in telephone-based social-engineering engagements. It has been reported that the data breach that affected Qantas Airlines in June, which was linked by some cybersecurity professionals to Scattered Spider, is likely linked to ShinyHunter. The outfit has also been linked to a data breach that impacted Allianz Life in July. The insurer revealed that the attackers exfiltrated sensitive data after gaining access to a third-party, cloud-based CRM system. CISA Updates Scattered Spider Advisory The US Cybersecurity and Infrastructure Security Agency (CISA) updated it advisory on Scattered Spider on July 29. CISA and international partners said they had identified new tactics, techniques and procedures (TTPs) associated with the cybercriminal group. These included more sophisticated social engineering techniques. While Scattered Spider initially began their activity relying on broad phishing campaigns, the threat actors are now employing more targeted and multilayered spearphishing and vishing operations. One hallmark of their activity is targeting IT help desks via spearphishing calls which aim to convince personnel to reset passwords and/or transfer MFA tokens. The update also highlighted new legitimate remote access tools that are exploited by Scattered Spider including Teleport.sh and AnyDesk. Additional malware and ransomware variants have also been identified that have been used to exfiltrate data and encrypt target organizations’ systems. CISA confirmed the group deployed DragonForce ransomware alongside its usual TTPs. Deployment of this ransomware encrypts a target organization’s VMware Elastic Sky X integrated (ESXi) servers. Earlier in 2025, it is understood that DragonForce encryptors were used as part of a cyber-attack against UK retailer Marks & Spencer which disrupted the company’s operations and online retail arm. CISA also identified RattyRAT as another malware used by the hackers. This is a Java-based remote access trojan used for persistent, stealth access and initial reconnaissance. CISA’s latest advisory recommends that organizations employ enhanced monitoring against unauthorized account misuse and look for risky logins within environments where sign-in attempts have been flagged as potentially compromised due to suspicious activity or unusual behavior.

An ongoing data extortion campaign targeting Salesforce customers may soon turn its attention to financial services and technology service providers, as ShinyHunters and Scattered Spider appear to be working hand in hand, new findings show. "This latest wave of ShinyHunters-attributed attacks reveals a dramatic shift in tactics, moving beyond the group's previous credential theft and database exploitation," ReliaQuest said in a report shared with The Hacker News. These include the use of adoption of tactics that mirror those of Scattered Spider, such as highly-targeted vishing (aka voice phishing) and social engineering attacks, leveraging apps that masquerade as legitimate tools, employing Okta-themed phishing pages to trick victims into entering credentials during vishing, and VPN obfuscation for data exfiltration. ShinyHunters, which first emerged in 2020, is a financially motivated threat group that has orchestrated a series of data breaches targeting major corporations and monetizing them on cybercrime forums like RaidForums and BreachForums. Interestingly, the ShinyHunters persona has been a key participant in these platforms both as a contributor and administrator. "The ShinyHunters persona partnered with Baphomet to relaunch the second instance of BreachForums (v2) in June 2023 and later launched the June 2025 instance (v4) alone," Sophos noted in a recent report. "The interim version (v3) abruptly disappeared in April 2025, and the cause is unclear." While the relaunch of the forum was short-lived and the bulletin board went offline around June 9, the threat actor has since been linked to attacks targeting Salesforce instances globally, a cluster of extortion-related activity that Google is tracking under the moniker UNC6240. Coinciding with these developments was the arrest of four individuals suspected of running BreachForums, including ShinyHunters, by French law enforcement authorities. However, the threat actor told DataBreaches.Net that "France rushed to make FALSE, INACCURATE arrests," raising the possibility that an "associate" member may have been caught. And that's not all. On August 8, a new Telegram channel conflating ShinyHunters, Scattered Spider, and LAPSUS$ called "scattered lapsu$ hunters" emerged, with the channel members also claiming to be developing a ransomware-as-a-service solution called ShinySp1d3r that they said will rival LockBit and DragonForce. Three days later, the channel was banned and removed by Telegram. Both Scattered Spider and LAPSUS$ have ties to a broader, nebulous collective dubbed The Com, a notorious network of experienced English-speaking cybercriminals that's known to engage in a wide range of malicious activities, including SIM swapping, extortion, and physical crime. "Scattered LAPSUS$ Hunters represents a new phase in cyber extortion where clout and chaos are as much the objectives as money," FalconFeeds said. "Their connection to known entities like Scattered Spider and ShinyHunters indicates this is less a “new” group than a rebranding and coalescence of existing threat actors responding to recent law enforcement heat." ReliaQuest said it has identified a coordinated set of ticket-themed phishing domains and Salesforce credential harvesting pages that are likely created for similar campaigns targeting Salesforce that are aimed at high-profile companies across various industry verticals. These domains, the company said, were registered using infrastructure typically associated with phishing kits commonly used to host single sign-on (SSO) login pages -- a hallmark of Scattered Spider's attacks impersonating Okta sign-in pages. Furthermore, an analysis of over 700 domains registered in 2025 that matched Scattered Spider phishing patterns has revealed that domain registrations targeting financial companies have increased by 12% since July 2025, while targeting of technology firms has decreased by 5%, suggesting that banks, insurance companies and financial services could be next in line. The tactical overlaps aside, that the two groups may be collaborating is borne out by the fact that they have targeted the same sectors (i.e., retail, insurance, and aviation) around the same time. "Supporting this theory is evidence such as the appearance of a BreachForums' user with the alias 'Sp1d3rHunters,' who was linked to a past ShinyHunters breach, as well as overlapping domain registration patterns," researchers Kimberley Bromley and Ivan Righi said, adding the account was created in May 2024. "If these connections are legitimate, they suggest that collaboration or overlap between ShinyHunters and Scattered Spider may have been ongoing for more than a year. The synchronized timing and similar targeting of these previous attacks strongly support the likelihood of coordinated efforts between the two groups." Update The threat actor collective ShinyHunters has announced that BreachForums has been commandeered by international law enforcement agencies, and that the site has been turned into a honeypot. "The platform is currently being operated by French law enforcement agencies, including the BL2C, in coordination with the United States Department of Justice (DoJ) and the Federal Bureau of Investigation (FBI)," ShinyHunters claimed, adding the accounts "Hollow," "ShinyHunters" are compromised, and that the account "N/A" has been taken over by a federal agent. "Law enforcement never figured it out but I am here to confirm ShinyHunters alt accounts were Anastasia and Hollow. Anastasia and Hollow administrator accounts were always controlled by one person, me, ShinyHunters." ShinyHunters' alleged leader, Shiny, also had a word of caution: "If BreachForums remains online following this notice, it is operating as a honeypot under the control of multiple international law enforcement agencies. BreachForums will not be returning under legitimate operation. Any reappearance of the site should be regarded as a law enforcement trap."

At the heart of multiple data breaches against sophisticated and robust companies, including Google, Adidas, Louis Vuitton, and Chanel, was a rudimentary attack method that required little technical finesse—making a phone call. By disguising themselves as IT support personnel on the phone, hackers belonging to the group “ShinyHunters” successfully tricked the employees at several multinational corporations into handing over the data within their own Salesforce platforms. The attacks underscore the vulnerability that all businesses face—large or small—in preventing cyberattacks that begin through basic social engineering scams. In a bizarre twist of irony, security researchers at Google Threat Intelligence Group (GITG) originally uncovered the hacking campaign in June, only to announce that Google itself had been hit by the very same tactic this week. Other victims in the hacking campaign include Allianz Life, the airline Qantas, and the jeweler Pandora. The data breaches all leverage a Salesforce feature that allows users to connect to various, external apps. This functionality allows business owners and employees to, for instance, connect their Salesforce data to mapping tools to visualize the locations of a customer base, or to connect their Salesforce data with a newsletter platform to deliver email marketing campaigns to specific customer segments. In the attacks, the hackers trick employees into connecting to a fraudulent version of Salesforce’s “Data Loader” app, which lets users import, export, update, and delete large quantities of data that are stored or managed within Salesforce itself. The process for connecting to an external app is simple, as employees just enter an 8-digit code when prompted by Salesforce. But once ensnared in the phone scam, employees are tricked into entering an 8-digit code that will connect to a data exfiltration program owned and operated entirely by the hackers. Once connected, the hackers are free to roam inside the company’s Salesforce data and steal what they see fit. Some attacks reportedly included an expansion by the hackers into other corporate online accounts, including Microsoft 365, which could reveal a company’s emails and other sensitive messages. In the attack against Google, the hackers accessed a Salesforce “instance,” which is a term used to describe a company or user’s implementation of software and the data they manage through that software (Think of it like when a hacker breaches an online account and then pilfers all the data related to that account and what it can access). In the Google attack, the Salesforce instance “was used to store contact information and related notes for small and medium businesses.” “Analysis revealed that data was retrieved by the threat actor during a small window of time before the access was cut off,” Google said. “The data retrieved by the threat actor was confined to basic and largely publicly available business information, such as business names and contact details.” According to the outlet Bleeping Computer, the ShinyHunters cybercrime group is still stealing business data through this attack campaign. Once the hackers have the data, they then extort the victims to pay a hefty ransom or risk having the data exposed online. How to stay safe from the Salesforce scam Because this attack is so targeted—every corporate victim uses Salesforce—the defense strategies are clear and actionable. Here’s how you can help yourself and your staff in avoiding this attack. Audit your Salesforce access. Ensure that the only employees or staff who have access to Salesforce are those who need to use it for their job. When there are fewer employees who can access Salesforce, there are fewer entry points for hackers. Train your staff. Recognizing a social engineering scam is important for any workforce, no matter the size. Inform your employees and yourself about your current IT support provider so that any rogue phone calls are immediately caught. Use multifactor authentication (MFA) for important accounts. The hackers in these attacks managed to gain access to other cloud applications like Microsoft 365. Protect all your employee accounts on sensitive platforms with MFA. Social engineering scams are some of the most effective and serious threats to small businesses. It’s important to recognize them when they happen. And for all else, use always-on cybersecurity to protect your business from malware, viruses, and nefarious break-in attempts.

FBI warns of Scattered Spider and ShinyHunters attacks on Salesforce platforms Hackers connected to the Scattered Spider and ShinyHunters cybercriminal operations are extorting organizations for exorbitant ransoms after stealing data from Salesforce, the FBI warned. The agency released a flash notice on Friday with information about an ongoing data theft campaign that has impacted hundreds of businesses this year. The FBI refers to the hackers as both UNC6040 and UNC6395 and by their colloquial names of ShinyHunters and Scattered Spider, respectively. After months spent breaching some of the largest companies in the world, the hackers are now attempting to extort victim organizations — threatening to leak troves of customer data, business documents and more. The FBI did not say how many victims have received extortion emails demanding payment in cryptocurrency but they noted that the monetary demands have varied widely and are made at seemingly random times. Some extortion incidents were initiated days after data exfiltration while others took place months later. The FBI said the campaign began in October 2024 when members of the group gained access to organizations through social engineering attacks that involved contacting call centers and posing as IT employees. That scheme typically gave the cybercriminals access to employee credentials that were then leveraged to access Salesforce instances holding customer data. In other cases, the hackers used phishing emails or texts to take over employees’ phones or computers. The hackers evolved their tactics throughout the summer, switching to exploiting third-party applications that organizations linked to their Salesforce instances. “UNC6040 threat actors have deceived victims into authorizing malicious connected apps to their organization's Salesforce portal,” the FBI said. “This grants UNC6040 threat actors significant capabilities to access, query, and exfiltrate sensitive information directly from the compromised Salesforce customer environments.” By August, the hackers began targeting the Salesloft Drift application, an AI chatbot that can be integrated with Salesforce. The tactic allowed them to bypass traditional defenses like multifactor authentication, login monitoring and password resets, the FBI explained. In some cases, the FBI has found that the hackers created malicious applications within Salesforce trial accounts that allowed them to register connected apps without using a legitimate corporate account. On Monday, Reuters and the BBC confirmed that Kering — the French conglomerate that owns Gucci, Balenciaga and Alexander McQueen — was attacked by the same ShinyHunters cybercriminals. ShinyHunters told the BBC that it stole information connected to 7.4 million unique email addresses. The hackers told another news outlet that they stole the information in late 2024 but only began negotiating a ransom in June 2025. Last week, a critical government agency in Vietnam confirmed that millions of financial records were stolen in an attack claimed by ShinyHunters. The cybercriminals previously took credit for devastating campaigns targeting giants in the insurance, retail and aviation industries. The FBI provided indicators of compromise that potential victims can use to see whether they have been affected by the hacking campaigns and urged companies to train call center employees on the tactics used. The agency also said companies should limit the privileges of almost every employee account, enforce IP-based access restrictions, monitor API usage and more. Experts said the information provided by the FBI showed how sophisticated the actors are at abusing legitimate tools for nefarious purposes, like Azure cloud infrastructure, virtual servers, Tor exit nodes and proxy services to obfuscate their origin. Scattered retirement? The FBI notice came shortly after the group made several posts on Telegram claiming to be retiring. The group blamed a recent string of arrests, law enforcement activity and criminal convictions against members as their reason for ceasing the current operation. Cybersecurity experts were dubious about the disbanding claims, noting that cybercriminal operations often make similar claims before reconstituting under different names. Some theorized the hackers are likely going to enjoy the spoils of their recent extortion campaigns before returning to cybercriminal activity. Sam Rubin, a senior official with Palo Alto Networks’ Unit 42, said recent arrests may have prompted the group to lay low, but history says such activity is often temporary. “Groups like this splinter, rebrand, and resurface — much like ShinyHunters. Even if public operations pause, the risks remain: stolen data can resurface, undetected backdoors may persist, and actors may re-emerge under new names,” he said. “Silence from a threat group does not equal safety.” Jonathan Greig is a Breaking News Reporter at Recorded Future News. Jonathan has worked across the globe as a journalist since 2014. Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia. He previously covered cybersecurity at ZDNet and TechRepublic.

An extortion group has launched a new data leak site to publicly extort dozens of companies impacted by a wave of Salesforce breaches, leaking samples of data stolen in the attacks. The threat actors responsible for these attacks claim to be part of the ShinyHunters, Scattered Spider, and Lapsus$ groups, collectively referring to themselves as "Scattered Lapsus$ Hunters." Today, they launched a new data leak site containing 39 companies impacted by the attacks. Each entry includes samples of data allegedly stolen from victims' Salesforce instances, and warns the victims to reach out to "prevent public disclosure" of their data before the October 10 deadline is reached. The companies being extorted on the data leak site include well-known brands and organizations, including FedEx, Disney/Hulu, Home Depot, Marriott, Google, Cisco, Toyota, Gap, McDonald's, Walgreens, Instacart, Cartier, Adidas, CarMax, Sake Fifth Avenue, Air France & KLM, Transunion, HBO MAX, UPS, Chanel, and IKEA. "All of them have been contacted long ago, they saw the email because I saw them download the samples multiple times. Most of them chose to not disclose and ignore," ShinyHunters told BleepingComputer. "We highly advise you proceed into the right decision, your organisation can prevent the release of this data, regain control over the situation and all operations remain stable as always. We highly recommend a decision-maker to get involved as we are presenting a clear and mutually beneficial opportunity to resolve this matter," they warned on the leak site. The threat actors also added a separate entry requesting that Salesforce pay a ransom to prevent all impacted customers' data (approximately 1 billion records containing personal information) from being leaked. "Should you comply, we will withdraw from any active or pending negotiation indiviually from your customers. Your customers will not be attacked again nor will they face a ransom from us again, should you pay," they added. The extortion group also threatened the company, stating that it would help law firms pursue civil and commercial lawsuits against Salesforce following the data breaches and warned that the company had also failed to protect customers' data as required by the European General Data Protection Regulation (GDPR). Scattered Lapsus$ Hunters have been targeting Salesforce customers with voice phishing attacks since the beginning of the year, leading to breaches that have impacted companies such as Google, Cisco, Qantas, Adidas, Allianz Life, Farmers Insurance, Workday, as well as LVMH subsidiaries, including Dior, Louis Vuitton, and Tiffany & Co. In these attacks, the threat actors tricked employees into linking a malicious OAuth app to their company's Salesforce instance. ShinyHunters told BleepingComputer that while a particular Salesforce instance may have been targeted, it also contained data for many of the subsidiaries, making the attacks more impactful. Once connected, the attackers stole company databases and used the data to extort victims via email. These extortion emails were signed by ShinyHunters, a notorious extortion group linked to a long string of high-profile breaches in recent years, including the Snowflake attacks and those against AT&T and PowerSchool. ShinyHuntersalso claimed to have used stolen OAuth tokens for Salesloft's Drift AI chat integration with Salesforce to steal sensitive information, including passwords, AWS access keys, and Snowflake tokens, from customers' Salesforce instances. These attacks were tracked by Mandiant under a separate threat cluster named "UNC6395" as they have been unable to formally link the breaches to this group. On a Telegram channel associated with the extortion group, the threat actors claim that they will begin extorting companies affected by the Salesloft Drift attacks on a separate data leak site launching on October 10th. The Salesloft attacks are known to have impacted Google, Palo Alto Networks, CyberArk, Cloudflare, Rubrik, Elastic, BeyondTrust, Proofpoint, JFrog, Zscaler, Tenable, Nutanix, Qualys, and Cato Networks, among many others. ShinyHunters claim that companies will not be re-extorted under the Salesloft campaign if a ransom is paid in this initial extortion phase. "We are aware of recent extortion attempts by threat actors, which we have investigated in partnership with external experts and authorities. Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support," Salesforce said in a statement published after ShinyHunters launched their data leak site. "At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology." Update October 03, 11:02 EDT: Added Salesforce statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report