adidas

Scattered Lapsus$ Hunters seeks women for vishing attacks The Scattered Lapsus$ Hunters (SLH) hacking collective has launched a recruitment push aimed specifically at women, offering cash payments for participating in voice-phishing (vishing) attacks. A few days ago, threat intelligence firm Dataminr detected posts on a public Telegram channel advertising roles for female callers willing to conduct social-engineering phone operations. SLH’s recruitment ad (Source: Dataminr) The group is apparently offering between $500 and $1,000 per call, up front, and is supplying prepared scripts to guide these recruits through impersonation attempts. About Scattered Lapsus$ Hunters SLH is an informal coalition drawing from members associated with Lapsus$, Scattered Spider, and ShinyHunters, three groups linked to the (predominantly) English-speaking (cyber)crime network known as The Com. Past arrests and court cases involving individuals tied to Lapsus$ and Scattered Spider have largely involved young men, though the demographic makeup membership of such groups is likely fluid. The group has been operating for a while now, and has successfully targeted high-profile organizations such as Jaguar Land Rover, Adidas, Qantas, and many others. Scattered Spider members are known for their social engineering skills (particularly vishing), and their tendency to bypass multi-factor authentication protections through SIM swapping, fake single sign-on (SSO) pages, and MFA prompt bombing (aka MFA fatigue). They also have a penchant for targeting corporate IT help desk and support personnel via phone by impersonating employees and convincing the former to change account passwords, as well as impersonating support personnel to get employees to install remote monitoring and management (RMM) tools or logging into their accounts via phishing sites. According to cybersecurity company Silent Push, they are leveraging adaptable phishing kits that allow them to syncronize the authentication flow on those phishing pages with the requests made during phishing calls. Advice for organizations Dataminr advises organizations to start briefing IT help desk and support personnel about this specific recruitment trend and teach them to expect vishers (whether male or female) to be well-rehearsed and very convincing. “Enforce out-of-band identity verification (e.g., video calls or secondary internal verification) for all password resets or MFA credential changes requested via phone,” the company counsels. Where possible, organizations should switch to using phishing-resistant authentication methods (e.g., FIDO2-compliant hardware security keys or passkeys), and they should “audit logs for new user creation or administrative privilege escalation immediately following help desk interactions.” Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

Week in review: Firmware-level Android backdoor found on tablets, Dell zero-day exploited since 2024 Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Security at AI speed: The new CISO reality The CISO role has changed significantly over the past decade, but according to John White, EMEA Field CISO, Torq, the most disruptive shift is accountability driven by agentic AI. In this Help Net Security interview, White explains how security leaders must design and govern hybrid workforces where humans and AI agents operate side by side, making decisions and acting at scale. He notes that automation is moving beyond simple task execution into real-time insight and response. REMnux v8 brings AI integration to the Linux malware analysis toolkit REMnux, a specialized Linux distribution for malware analysis, has released version 8 with a rebuilt platform based on Ubuntu 24.04 and a new capability aimed at connecting AI agents directly to its toolset. Your encrypted data is already being stolen Quantum computing is often treated as a distant, theoretical cybersecurity issue. According to Ronit Ghose, Global Head, Future of Finance of Citi Institute, that mindset is already putting financial institutions at risk. The biggest misconception, he says, is that quantum threats begin on a single future Q-day, when quantum machines suddenly crack encryption. In reality, adversaries can harvest encrypted data today and decrypt it later, creating long-term exposure for banks handling sensitive identity and transaction data. SecureClaw: Dual stack open-source security plugin and skill for OpenClaw SecureClaw is an open-source project that adds security auditing and rule-based controls to OpenClaw agent environments. The tool is published by Adversa AI and is designed to work with OpenClaw and related agents such as Moltbot and Clawdbot. Everyone uses open source, but patching still moves too slowly Enterprise security teams rely on open source across infrastructure, development pipelines, and production applications, even when they do not track it as a separate category of technology. Open source has become a default building block in many environments, and the operational risks now look like standard enterprise security problems: patch delays, version sprawl, and aging platforms that stay online longer than planned. The defense industrial base is a prime target for cyber disruption Cyber threats against the defense industrial base (DIB) are intensifying, with adversaries shifting from traditional espionage toward operations designed to disrupt production capacity and compromise supply chains. In this Help Net Security interview, Luke McNamara, Deputy Chief Analyst, Google Threat Intelligence Group, explains how attackers target the broader defense ecosystem and why identity has become the new security boundary. One stolen credential is all it takes to compromise everything Attackers often gain access through routine workflows like email logins, browser sessions, and SaaS integrations. A single stolen credential can give them a quick path to move across systems when access permissions are broad and visibility is fragmented. That pattern appears across more than 750 incident response engagements covered in Unit 42’s Global Incident Response Report 2026. The CISO view of fraud risk across the retail payment ecosystem In this Help Net Security interview, Paul Suarez, VP and CISO at Casey’s, explains how his team manages patching and upgrades for fuel payment systems with long hardware lifecycles. He also discusses risks tied to QR code payments and outlines why loyalty abuse can be hard to spot. Suarez shares how Casey’s monitors payment systems across stores, corporate networks, and third-party processors. Google patches Chrome vulnerability with in-the-wild exploit (CVE-2026-2441) Google released a security update for Chrome to address a high-severity zero‑day vulnerability (CVE-2026-2441) on Friday. CVE-2026-2441 is a use-after-free bug in the CSS processing component of Google Chrome, which allows a remote attacker “to execute arbitrary code inside a sandbox via a crafted HTML page.” OpenClaw creator Peter Steinberger joins OpenAI Peter Steinberger, the Austrian software developer who vibe coded the popular OpenClaw autonomous AI agent, has joined OpenAI. The reason why Steinberger chose OpenAI to achieve this goal is, professedly, his lack of interest in building a company and his wish to “change the world” – and do it quickly. Firmware-level Android backdoor found on tablets from multiple manufacturers A new Android backdoor embedded directly in device firmware can quietly take control of apps and harvest data, Kaspersky researchers found. The malware, named Keenadu, was discovered during an investigation into earlier Android threats and appears to have been inserted during the firmware build process, not after devices reached users.  Design weaknesses in major password managers enable vault attacks, researchers say Can cloud-based password managers that claim “zero-knowledge encryption” keep users’ passwords safe even if their encrypted-vault servers are compromised? Researchers at ETH Zurich and Università della Svizzera italiana set out to answer that question, and the answer is (unfortunately) no. Notepad++ secures update channel in wake of supply chain compromise Notepad++, the popular text and source code editor for Windows whose update mechanism was hijacked last year, has been updated to prevent similar attacks in the future. The hijacking of the update mechanism was confirmed earlier this month by Notepad++ maintainer Don Ho. Scammers exploit trust in Atlassian Jira to target organizations Threat actors have leveraged legitimate email notification feature of Atlassian Jira to deliver localized scam emails at scale. From late December 2025 through late January 2026, victims were targeted with spam emails from legitimate-looking Atlassian Jira Cloud addresses. China-linked hackers exploited Dell zero-day since 2024 (CVE-2026-22769) A suspected China-linked cyberespionage group has been covertly exploiting a critical zero-day flaw (CVE-2026-22769) in Dell’s RecoverPoint for Virtual Machines software since at least mid-2024, according to new research from Google’s threat intelligence team and Mandiant. The attackers deployed stealthy backdoors (BRICKSTORM and GRIMBOLT), a webshell (SLAYSTYLE) and maintained long-term access inside targeted networks. Bug in widely used VoIP phones allows stealthy network footholds, call interception (CVE-2026-2329) A critical security vulnerability (CVE-2026-2329) in Grandstream VoIP phones could let hackers remotely take full control of the devices and even intercept calls, Rapid7 researchers discovered. Data on 1.2 million French bank accounts accessed in registry breach In late January 2026, a malicious intruder accessed France’s national bank account registry, FICOBA, enabling them to view information tied to 1.2 million accounts, the Ministry of the Economy and Finance disclosed on Wednesday. TV5 Monde reported that the perpetrator (or perpetrators) obtained login credentials belonging to a civil cervant authorized to use the database and then used those credentials to explore its contents. Microsoft reveals critical Windows Admin Center vulnerability (CVE-2026-26119) Microsoft has disclosed a privilege-escalation vulnerability in Windows Admin Center (WAC), a browser-based platform widely used by IT administrators and infrastructure teams to manage Windows clients, servers, clusters, Hyper-V hosts and virtual machines, as well as Active Directory-joined systems. Criminals create business website to sell RAT disguised as RMM tool A RAT masquerading as legitimate remote monitoring and management (RMM) software is being sold to cybercriminals as a service, Proofpoint researchers recently discovered. The fake RMM tool, called TrustConnect, was being marketed via an LLM-created website parked on trustconnectsoftware[.]com, supposedly belonging to “TrustConnect Software PTY LTD”. LockBit 5.0 ransomware expands its reach across Windows, Linux, and ESXi The Acronis Threat Research Unit (TRU) has identified a new and significantly enhanced version of the LockBit ransomware, LockBit 5.0, currently being deployed in active campaigns. The latest variant demonstrates expanded cross-platform capabilities, enabling attackers to target Windows, Linux, and VMware ESXi systems within a single coordinated attack. Don’t panic over CISA’s KEV list, use it smarter In this Help Net Security video, Tod Beardsley, VP of Security Research at runZero, explains what CISA’s Known Exploited Vulnerabilities (KEV) Catalog is and how security teams should use it. He shares his perspective as a former section chief for KEV at CISA and breaks down common misunderstandings about what the list represents. Cybersecurity in cross-border logistics operations In this Help Net Security video, Dieter Van Putte, CTO at Landmark Global, discusses how cybersecurity has become a core part of global supply chain operations. He explains that logistics is now also about data moving between carriers, customs authorities, warehouses, brokers, and customers. That constant flow increases risk and expands the attack surface. In GitHub’s advisory pipeline, some advisories move faster than others GitHub Security Advisories are used to distribute vulnerability information in open-source projects and security tools. A new study finds that only a portion of those advisories ever pass through GitHub’s formal review process. Android 17 beta brings privacy, security, and performance changes Google has released the first beta of Android 17, giving developers an early view of changes to core app behavior, platform tooling, performance, media handling, and connectivity. The company plans to move quickly from this beta toward the Platform Stability milestone, targeted for March, where final APIs and behavior definitions for apps will be delivered. UK sets course for stricter AI chatbot regulation The UK government has announced immediate action to force AI chatbot providers to comply with laws requiring online platforms to protect children from illegal and harmful content. Providers that fail to meet these duties will face legal consequences. Microsoft equips CISOs and AI risk leaders with a new security tool Microsoft released Security Dashboard for AI in public preview for enterprise environments. The dashboard aggregates posture and real-time risk signals from Microsoft Defender, Microsoft Entra, and Microsoft Purview into a single view within security tools. Phobos ransomware affiliate arrested in Poland Officers from Poland’s Central Bureau for Combating Cybercrime (CBZC) detained a 47-year-old man suspected of creating, acquiring, and sharing computer programs used to unlawfully obtain information stored in computer systems. He faces a potential prison sentence of up to five years. Pressure builds on Grok AI, Ireland launches investigation The Irish Data Protection Commission (DPC) opened an investigation into X over concerns that its Grok AI chatbot was used to generate sexualized deepfakes. The investigation focuses on the apparent creation and publication of potentially harmful, non-consensual intimate or sexualised images on X using generative AI tools linked to the platform’s Grok LLM. Claude Sonnet 4.6 launches with improved coding and expanded developer tools Anthropic released Claude Sonnet 4.6, marking its second major AI launch in less than two weeks. According to Anthropic, Sonnet 4.6 delivers improved coding skills to more users. Tasks that once required an Opus-class model, including economically valuable office work, are handled by Sonnet 4.6. The model also brings improvements in computer use capabilities compared to earlier Sonnet versions. Attackers keep finding the same gaps in security programs Attackers keep getting in, often through the same predictable weak spots: identity systems, third-party access, and poorly secured perimeter devices. A new threat report from Barracuda based on Managed XDR telemetry from 2025 shows that many successful incidents still start with basic access and configuration failures, not advanced malware. Microsoft signals breakthrough in data storage that can last for generations Microsoft announced progress on Project Silica, its research initiative focused on developing durable, long-term quartz glass-based data storage technology. Rising global data volumes increase the need for storage that can last for generations. Researchers believe this technology could preserve information for up to 10,000 years. UK sounds alarm on rising cyber risks to businesses The UK government launched a national campaign urging businesses to strengthen basic cyber defenses. The initiative follows new figures highlighting the scale of the threat. Serious cyber incidents cost businesses an average of £195,000, with about half of small firms experiencing one in the past 12 months, officials say. Open-source benchmark EVMbench tests how well AI agents handle smart contract exploits EVMbench is a new open-source benchmark designed to test AI agents on practical smart contract security tasks. The benchmark was developed by OpenAI and Paradigm, and it focuses on real-world vulnerability patterns drawn from audited codebases and contest reports. Adidas investigates alleged data breach affecting 815,000 records Adidas confirmed it is investigating a possible data breach involving one of its third-party customer service providers. The company stated that there is no indication its IT infrastructure, e-commerce platforms, or consumer data were impacted by the incident. Poland restricts Chinese-made cars at protected military sites Poland’s military leadership has decided that cars manufactured in the People’s Republic of China will no longer cross the gates of sensitive military bases. The decision follows a risk analysis focused on the growing integration of digital systems in cars and the potential for uncontrolled acquisition and use of data by those systems. 651 arrested, $4.3 million recovered in African cybercrime sweep Operation Red Card 2.0, supported by INTERPOL and involving law enforcement agencies from 16 African countries, led to 651 arrests and the recovery of more than $4.3 million from online scams. Running from 8 December 2025 to 30 January 2026, the operation targeted networks behind high-yield investment fraud, mobile money scams and fraudulent loan applications that caused more than $45 million in losses. Man gets five years for aiding North Korean IT employment scam Ukrainian national Oleksandr Didenko, 29, was sentenced in U.S. District Court to 5 years in prison for an identity theft scheme that enabled North Korean workers to secure fraudulent employment. Ex-Google engineers charged with orchestrating high-tech secrets extraction A federal grand jury has indicted three Silicon Valley engineers on charges in a scheme to steal trade secrets from Google and other leading technology companies. MOS: Open-source modular OS for servers and homelabs A growing number of homelab builders and small server operators are testing an open source operating system that combines basic server management, storage control, and container services under a web interface. MOS is a free modular OS built on a Devuan base that provides a web UI and API for system monitoring, storage pooling, container orchestration, and virtualization. Apple privacy labels often don’t match what Chinese smart home apps do Smart home devices in many homes collect audio, video, and location data. The apps that control those devices often focus on the account owner, even when the technology also captures guests, neighbors, and other people who never agreed to be monitored. New research examined whether Chinese smart home apps provide privacy protections for these bystanders. Vim 9.2 adds scripting updates, diff improvements, and experimental Wayland support Vim 9.2 adds a range of incremental changes focused on scripting, usability, and cross-platform support. The update includes improvements to completion behavior, expanded Vim9 language features, and new options for diff mode. ChatGPT gets new security feature to fight prompt injection attacks OpenAI has introduced Lockdown Mode and Elevated Risk labels in ChatGPT to help users and organizations reduce the risk of prompt injection attacks and other advanced security threats, particularly when using features that interact with external systems. OT teams are losing the time advantage against industrial threat actors In many industrial environments, internet-facing gateways, remote access appliances, and boundary systems sit close enough to production networks that attackers can move from IT intrusion to operational disruption with limited resistance. Dragos’ 2026 OT/ICS Year in Review describes a threat landscape where adversaries are spending more time learning how physical processes work and less time treating OT access as a passive foothold. AWS coding agents gain new plugin support across development tools AI coding assistants have become a routine part of many development workflows, helping engineers write, test, and deploy code from IDEs or command line interfaces. One recent change in this ecosystem makes it possible for those agents to interact with AWS in a broader set of ways by adding a library of plugins that give agents specific AWS knowledge and actions. Microsoft Defender update lets SOC teams manage, vet response tools Microsoft introduced library management in Microsoft Defender to help security analysts working with live response manage scripts and tools they use to triage, investigate and remediate threats. The library management interface allows analysts to organize their investigation tools and manage everything without waiting for an active session. Consumers feel less judged by AI debt collectors Debt collection agencies are starting to use automated voice systems and AI-driven messaging to handle consumer calls. These systems help scale outreach, reduce call center staffing demands, and offer 24/7 service. A new study covering 11 European countries found that this shift changes how consumers emotionally experience debt collection, especially around stigma and empathy. Men sentenced to 8 years in $1.3 million computer intrusion and tax fraud scheme Matthew A. Akande, a Nigerian national, was sentenced by a U.S. District Court to eight years in prison, followed by three years of supervised release, for his role in a scheme to break into Massachusetts tax preparation firms’ computer networks and file fraudulent tax returns. The operation generated over $1.3 million in fraudulent tax refunds. Public mobile networks are being weaponized for combat drone operations On June 1, 2025, Ukraine launched drone strikes on five Russian airfields, damaging or destroying aircraft. More than 100 explosive drones used mobile networks to transmit data, receive instructions, and send images. Enea researchers analyzed the growing use of mobile-connected drones in conflict and the implications for national infrastructure. PromptSpy: First Android malware to use generative AI in its execution flow ESET researchers have discovered PromptSpy, the first known Android malware to abuse generative AI as part of its execution flow in order to achieve persistence. This marks the first time generative AI has been deployed in this way. Uptime Kuma: Open-source monitoring tool Service availability monitoring remains a daily operational requirement across IT teams, SaaS providers, and internal infrastructure groups. Many environments rely on automated checks and alerting to track outages, latency issues, and service degradation across web applications and network endpoints. Uptime Kuma is an open-source uptime monitoring project that supports this type of operational monitoring through a self-hosted deployment model. Quantum security is turning into a supply chain problem Supplier onboarding, invoice processing, and procurement platforms run on encrypted data flows that were built for long-term trust. In many organizations, that trust still depends on cryptographic standards like RSA and elliptic curve cryptography (ECC), even as security teams begin planning for a post-quantum world. A recent apexanalytix research report argues that supply chain leaders are already operating inside a quantum risk window, even though large-scale quantum computing remains years away. LINK“>Google cleans house, bans 80,000 developer accounts from the Play Store Google prevented more than 1.75 million policy-violating apps from being published on Google Play and banned over 80,000 developer accounts that attempted to publish harmful apps in 2025. Developer verification, mandatory pre-review checks, and testing requirements in the Google Play ecosystem have reduced entry points for bad actors. LLMs change their answers based on who’s asking AI chatbots may deliver unequal answers depending on who is asking the question. A new study from the MIT Center for Constructive Communication finds that LLMs provide less accurate information, increase refusal rates, and sometimes adopt a different tone when users appear less educated, less fluent in English, or from particular countries. Applying green energy tax policies to improve cybersecurity For years, governments have focused only on the stick of compliance when they could leverage the carrot of tax incentives. Theoretically, compliance fines and penalties should act as a deterrent that improves accountability and reduces data breaches. However, many vendors often assume compliance risk rather than securing data effectively. The era of the Digital Parasite: Why stealth has replaced ransomware For years, ransomware encryption signaled a breach. When systems locked up, defenders knew an attack had occurred. Data from Picus Security’s Red Report 2026 shows attackers shifting their strategy from disruption to persistence. Cybersecurity jobs available right now: February 17, 2026 We’ve scoured the market to bring you a selection of roles that span various skill levels within the cybersecurity field. Check out this weekly selection of cybersecurity jobs available right now. New infosec products of the week: February 20, 2026 Here’s a look at the most interesting products from the past week, featuring releases from Compliance Scorecard, Impart Security, Redpanda, and Virtana.

Adidas investigates alleged data breach affecting 815,000 records Adidas confirmed it is investigating a possible data breach involving one of its third-party customer service providers. The company stated that there is no indication its IT infrastructure, e-commerce platforms, or consumer data were impacted by the incident. An individual claiming to belong to the Lapsus$ Group posted on BreachForums alleging they had compromised the sportswear giant’s extranet. The stolen dataset is described as containing 815,000 rows of information, including names, email addresses, passwords, birthdays, company names and technical data. Lapsus$ is part of the hacker collective Scattered Lapsus$ Hunters, specializing in social engineering attacks. If confirmed, Adidas would be the latest organization linked to the group’s activity in recent years. This is not the first time Adidas has experienced a cybersecurity incident. In May 2025, the company notified customers that some of their data had been stolen after an unauthorized individual gained access to a third-party system.

DEVOPS Go updates may delight diehard gophers but displease AI overlordsv 1.27 expands generics to support methods EDGE AND IOT Waymo has designed a robocar chip to stay ahead of Tesla5 nm ML accelerators promise 1,000+ TOPS, ultra-low latency SYSTEMS AMD inches closer to its goal of making AI suck less ... energyHouse of Zen claims latest systems already 4x more efficient than two years ago Google pits Marvell against Broadcom as it chases AI crownAnd Marvell just offered the Chocolate Factory a $12.2B stake to sweeten the deal SYSTEMS Cerebras CS-4 rack systems juice chips for every last drop of AI performanceNext-gen systems double per-chip performance while cramming 3x as many into a rack Security Russians are posing as Signal support to launch phishing attacksPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more! Security Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attackPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more Black Hat and DEF CON DEF CON Franklin project enlists hackers to harden critical infrastructureVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included Security EQT buys majority share in Swiss cybersecurity biz AcronisWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified Malware Month Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sightOn the plus side, infosec's a good bet for a long, stable career FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash anotherWord up GNOME can look like Windows – and Flashback can do it without extensionsNew 'Simple-taskbar' is an option, but there's a simpler, stabler way A moment of silence, please, for the final release of Debian on x86-32New Debian versions hit FOSSland in the form of 13.6 and 12.15 Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide Frame: A new X11 server – implemented directly in assemblyJoins yserver, Phoenix, and of course XLibre – and outlier Arcan Cinnamon 6.8 will support Wayland – if you want itNext version of Linux Mint’s desktop has both kinds of display server

I did not know Adidas sold a sneaker called “ Squid .” As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Blog moderation policy.

Mango says some customer information exposed in cyber incident Spanish fast-fashion retailer Mango said that one of its external marketing service providers suffered a data breach exposing limited customer information, though its own corporate systems were not affected. In a statement on Tuesday, the company said the compromised data included customers’ first names, countries, postal codes, email addresses and phone numbers, but did not include last names, passwords or financial information such as credit card or banking details. “Mango’s infrastructure and corporate systems have not been compromised,” the company said, adding that it had notified the Spanish Data Protection Agency (AEPD) and other authorities in line with regulations. Mango’s top markets include Spain, France and Turkey. The company has dozens of U.S. stores and more than 2,700 worldwide. The incident is the latest in a string of cyberattacks targeting Spanish and global retailers. In March, El Corte Ingles disclosed that a breach at one of its third-party suppliers exposed customer identification and credit card details. Another Spanish chain, Tendam, was hit by hackers who reportedly stole 720 gigabytes of data and demanded an €800,000 ransom. Retailers across Europe have also been hit. Earlier this year, Co-op UK said a cyberattack wiped $274 million off its revenues, while Louis Vuitton confirmed breaches at its stores in Turkey, South Korea and the U.K. exposed customer data. Other global brands, including Victoria’s Secret, Dior, Tiffany, and Adidas, have also faced cyber incidents in recent months. Mango said it detected the incident over the weekend and immediately activated its security protocols. Its online operations were not disrupted. “We recommend that all our customers pay attention to any suspicious communications or requests for unusual actions, both by email and by phone,” the company added. Daryna Antoniuk is a reporter for Recorded Future News based in Ukraine. She writes about cybersecurity startups, cyberattacks in Eastern Europe and the state of the cyberwar between Ukraine and Russia. She previously was a tech reporter for Forbes Ukraine. Her work has also been published at Sifted, The Kyiv Independent and The Kyiv Post.

Salesforce has confirmed that it will not negotiate with or pay a ransom to the threat actors behind a massive wave of data theft attacks that impacted the company's customers this year. As first reported by Bloomberg, Salesforce emailed customers on Tuesday to say they would not be paying a ransom and warned that "credible threat intelligence" indicates the threat actors were planning to leak the stolen data. "I can confirm Salesforce will not engage, negotiate with, or pay any extortion demand," Salesforce also confirmed to BleepingComputer. This statement follows the launch of a data leak site by threat actors known as "Scattered Lapsus$ Hunters," who are attempting to extort 39 companies whose data was stolen from Salesforce. The website was located on the breachforums[.]hn domain, which is named after the notorious BreachForums website, a hacking forum known for selling and leaking stolen data. The companies being extorted on the data leak site included well-known brands and organizations, including FedEx, Disney/Hulu, Home Depot, Marriott, Google, Cisco, Toyota, Gap, Kering, McDonald's, Walgreens, Instacart, Cartier, Adidas, Sake Fifth Avenue, Air France & KLM, Transunion, HBO MAX, UPS, Chanel, and IKEA. In total, the threat actors claimed to have stolen nearly 1 billion data records, which would be publicly released if an extortion demand was paid by individual companies or as a single payment from Salesforce that would cover all the impacted customers listed on the site. This data was stolen from Salesforce instances in two separate campaigns that occurred in 2025. The first data theft campaign began at the end of 2024, when threat actors started conducting social engineering attacks impersonating IT support staff to trick employees into connecting a malicious OAuth application to their company's Salesforce instance. Once linked, the threat actors used the connection to download and steal the databases, which were then used to extort the company through email. These social engineering attacks impacted Google, Cisco, Qantas, Adidas, Allianz Life, Farmers Insurance, Workday, Kering, and LVMH subsidiaries, such as Dior, Louis Vuitton, and Tiffany & Co. A second Salesforce data-theft campaign began in early August 2025, when the threat actors used stolen SalesLoft Drift OAuth tokens to pivot to customers' CRM environments and exfiltrate data. The Salesloft data-theft attacks primarily focused on stealing support ticket data to scan for credentials, API tokens, authentication tokens, and other sensitive information that would enable the attackers to breach the company's infrastructure and cloud services. One of the threat actors behind the Salesloft attacks, known as ShinyHunters, told BleepingComputer that they stole approximately 1.5 billion data records for over 760 companies during this campaign. Many companies have already confirmed they were impacted by the Salesloft supply-chain attack, including Google, Cloudflare, Zscaler, Tenable, CyberArk, Elastic, BeyondTrust, Proofpoint, JFrog, Nutanix, Qualys, Rubrik, Cato Networks, Palo Alto Networks, and many more. The recently launched data leak site was used primarily to extort customers in the original social engineering attacks, with the threat actors stating they would begin publicly extorting those impacted by the Salesloft attacks after October 10th. However, the data leak site is now shut down, with the domain now using nameservers of surina.ns.cloudflare.com and hans.ns.cloudflare.com, which have both been used by the FBI in the past when seizing domains. BleepingComputer contacted the FBI about whether they seized the domain but has not received a response at this time. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

An extortion group has launched a new data leak site to publicly extort dozens of companies impacted by a wave of Salesforce breaches, leaking samples of data stolen in the attacks. The threat actors responsible for these attacks claim to be part of the ShinyHunters, Scattered Spider, and Lapsus$ groups, collectively referring to themselves as "Scattered Lapsus$ Hunters." Today, they launched a new data leak site containing 39 companies impacted by the attacks. Each entry includes samples of data allegedly stolen from victims' Salesforce instances, and warns the victims to reach out to "prevent public disclosure" of their data before the October 10 deadline is reached. The companies being extorted on the data leak site include well-known brands and organizations, including FedEx, Disney/Hulu, Home Depot, Marriott, Google, Cisco, Toyota, Gap, McDonald's, Walgreens, Instacart, Cartier, Adidas, CarMax, Sake Fifth Avenue, Air France & KLM, Transunion, HBO MAX, UPS, Chanel, and IKEA. "All of them have been contacted long ago, they saw the email because I saw them download the samples multiple times. Most of them chose to not disclose and ignore," ShinyHunters told BleepingComputer. "We highly advise you proceed into the right decision, your organisation can prevent the release of this data, regain control over the situation and all operations remain stable as always. We highly recommend a decision-maker to get involved as we are presenting a clear and mutually beneficial opportunity to resolve this matter," they warned on the leak site. The threat actors also added a separate entry requesting that Salesforce pay a ransom to prevent all impacted customers' data (approximately 1 billion records containing personal information) from being leaked. "Should you comply, we will withdraw from any active or pending negotiation indiviually from your customers. Your customers will not be attacked again nor will they face a ransom from us again, should you pay," they added. The extortion group also threatened the company, stating that it would help law firms pursue civil and commercial lawsuits against Salesforce following the data breaches and warned that the company had also failed to protect customers' data as required by the European General Data Protection Regulation (GDPR). Scattered Lapsus$ Hunters have been targeting Salesforce customers with voice phishing attacks since the beginning of the year, leading to breaches that have impacted companies such as Google, Cisco, Qantas, Adidas, Allianz Life, Farmers Insurance, Workday, as well as LVMH subsidiaries, including Dior, Louis Vuitton, and Tiffany & Co. In these attacks, the threat actors tricked employees into linking a malicious OAuth app to their company's Salesforce instance. ShinyHunters told BleepingComputer that while a particular Salesforce instance may have been targeted, it also contained data for many of the subsidiaries, making the attacks more impactful. Once connected, the attackers stole company databases and used the data to extort victims via email. These extortion emails were signed by ShinyHunters, a notorious extortion group linked to a long string of high-profile breaches in recent years, including the Snowflake attacks and those against AT&T and PowerSchool. ShinyHuntersalso claimed to have used stolen OAuth tokens for Salesloft's Drift AI chat integration with Salesforce to steal sensitive information, including passwords, AWS access keys, and Snowflake tokens, from customers' Salesforce instances. These attacks were tracked by Mandiant under a separate threat cluster named "UNC6395" as they have been unable to formally link the breaches to this group. On a Telegram channel associated with the extortion group, the threat actors claim that they will begin extorting companies affected by the Salesloft Drift attacks on a separate data leak site launching on October 10th. The Salesloft attacks are known to have impacted Google, Palo Alto Networks, CyberArk, Cloudflare, Rubrik, Elastic, BeyondTrust, Proofpoint, JFrog, Zscaler, Tenable, Nutanix, Qualys, and Cato Networks, among many others. ShinyHunters claim that companies will not be re-extorted under the Salesloft campaign if a ransom is paid in this initial extortion phase. "We are aware of recent extortion attempts by threat actors, which we have investigated in partnership with external experts and authorities. Our findings indicate these attempts relate to past or unsubstantiated incidents, and we remain engaged with affected customers to provide support," Salesforce said in a statement published after ShinyHunters launched their data leak site. "At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology." Update October 03, 11:02 EDT: Added Salesforce statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Insurance giant Allianz subsidiary Allianz Life Insurance Company of North America is notifying roughly 1.5 million people that their personal information was stolen in a July data breach. The incident occurred on July 16 and involved a third-party cloud-based customer relationship management (CRM) system used by Allianz Life, the company told SecurityWeek in July. Only Allianz Life in the US was impacted, the company said, adding that most of its roughly 1.4 million customers were likely affected, without sharing an exact number. This week, however, the company notified the Maine Attorney General’s Office that the breach affects the data of 1,497,036 “Allianz Life customers, financial professionals, and select Allianz Life employees”. The stolen personal information includes names, addresses, dates of birth, and Social Security numbers, the insurer notes in the notification letter sent to the affected people. Allianz Life is providing the affected individuals with two years of free identity theft restoration and credit monitoring services. The company also said it has contained and mitigated the issue, and that the incident was limited to the third-party CRM, as none of its systems were accessed. While Allianz Life did not share details on the compromised CRM, the attack was attributed to the infamous Scattered Spider cybercrime group, which conducted a large-scale campaign targeting the Salesforce instances of major companies. Adidas, Cisco, Dior, Louis Vuitton, Google, Air France/KLM, and Workday are also believed to have been targeted in the campaign. Scattered Spider and its recent partner-in-crime ShinyHunters, a hacking group specializing in extortion, announced in mid-September their retirement, but cybersecurity specialists remain skeptical of their disappearance from the threat landscape. Related: Canadian Airline WestJet Says Hackers Stole Customer Data Related: Automotive Titan Stellantis Discloses Data Breach Related: Salesforce AI Hack Enabled CRM Data Theft Related: 33 Attorneys General Send Letter to FTC on Commercial Surveillance Rules

Automotive manufacturing giant Stellantis has confirmed that attackers stole some of its North American customers' data after gaining access to a third-party service provider's platform. Stellantis is a multinational corporation formed in 2021 after the merger of the PSA Group (Peugeot Société Anonyme) and Fiat Chrysler Automobiles (FCA). Stellantis is currently one of the largest automotive companies globally by revenue and the world's fifth-largest automaker by volume. The company owns 14 major automotive brands, including Alfa Romeo, Chrysler, Citroën, Dodge, DS Automobiles, Fiat, Jeep, Lancia, Maserati, Opel, Peugeot, Ram, and Vauxhall, and it operates manufacturing facilities across Europe, North America, South America, and other regions, with operations in over 130 countries. According to a statement published over the weekend, the attackers only stole customer contact information during the breach since the compromised platform was not used to store financial or other sensitive personal information. "We recently detected unauthorized access to a third-party service provider's platform that supports our North American customer service operations," Stellantis said. "Upon discovery, we immediately activated our incident response protocols, initiated a comprehensive investigation, and took prompt action to contain and mitigate the situation. We are also notifying the appropriate authorities and directly informing affected customers." The auto giant also advised customers to be cautious of potential phishing attempts and to refrain from clicking suspicious links or sharing personal information when receiving unexpected emails, texts, or calls. BleepingComputer reached out to Stellantis with questions about the incident, but a response was not immediately available. Salesforce data breach claimed by ShinyHunters Although Stellantis didn't share more information regarding this attack, BleepingComputer has learned that it is part of a recent wave of Salesforce data breaches linked with the ShinyHunters extortion group, which has affected numerous high-profile companies. Earlier today, ShinyHunters claimed responsibility for the Stellantis data breach and told BleepingComputer that they had stolen over 18 million Salesforce records, including names and contact details, from the company's Salesforce instance. Since the start of the year, the extortion group has been targeting Salesforce customers in data theft attacks using voice phishing attacks, impacting companies such as Google, Cisco, Qantas, Adidas, Allianz Life, Farmers Insurance, Workday, and LVMH subsidiaries, including Dior, Louis Vuitton, and Tiffany & Co. ShinyHunters also claims they used stolen OAuth tokens for Salesloft's Drift AI chat integration with Salesforce to steal sensitive information, such as passwords, AWS access keys, and Snowflake tokens, after gaining access to customers' Salesforce instances. Using this method, they claimed to have stolen customer information from Google, Cloudflare, Zscaler, Tenable, Palo Alto Networks, CyberArk, Nutanix, Qualys, Rubrik, Elastic, BeyondTrust, Proofpoint, JFrog, Cato Networks, and many more. Last week, the FBI released a Flash alert sharing IOCs discovered during the attacks and warning about threat actors breaching organizations' Salesforce environments to steal data and extort victims. Meanwhile, the extortion group told BleepingComputer that they had stolen over 1.5 billion Salesforce records from 760 companies, using compromised Salesloft Drift OAuth tokens. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

HR and finance giant Workday has disclosed a data breach that may be the result of an attack launched as part of a widespread campaign. Workday said threat actors gained access to a third-party customer relationship management (CRM) system and obtained “commonly available business contact information” such as names, phone numbers, and email addresses. The company, which has over 20,000 employees, said the attack was part of a social engineering campaign that hit many large organizations recently. In this campaign, attackers call or text employees at the targeted organization, claiming to represent IT or HR in an effort to trick them into handing over personal information or account access. “There is no indication of access to customer tenants or the data within them. We acted quickly to cut the access and have added extra safeguards to protect against similar incidents in the future,” Workday said. The HR firm believes the information obtained by the attackers may be useful for other social engineering attempts. Based on its brief description of the incident, the company may have joined a long list of major organizations whose Salesforce instances were targeted recently by the notorious cybercrime groups Scattered Spider and/or ShinyHunters, which may have merged recently. The list of companies apparently targeted in this campaign includes Adidas, Allianz Life, Cisco, Dior, Louis Vuitton, Google, and Air France and KLM. The attackers are relying on social engineering to gain access to targeted Salesforce instances and the attacks do not seem to involve exploitation of a vulnerability or access to Salesforce systems. Related: Manpower Says Data Breach Stemming From Ransomware Attack Impacts 140,000 Related: Connex Credit Union Data Breach Impacts 172,000 People Related: Columbia University Data Breach Impacts 860,000 Related: French Telecom Firm Bouygues Says Data Breach Affects 6.4M Customers

Business software giant Workday appears to have become the latest big name to suffer a data breach linked to a third-party Customer Relationship Management (CRM) platform. The firm issued a relatively short statement on Friday citing a “social engineering campaign targeting many large organizations,” including itself. “We recently identified that Workday had been targeted and threat actors were able to access some information from our third-party CRM platform,” it said. “There is no indication of access to customer tenants or the data within them. We acted quickly to cut the access and have added extra safeguards to protect against similar incidents in the future.” The data compromised in the attack was “primarily commonly available business contact information” including names, email addresses and phone numbers, the statement continued. Workday warned that such information could help the threat actors to launch follow-on social engineering scams and reminded customers that it would never contact them directly to request passwords or other “secure details.” The attack is strikingly similar to many others carried out by the ShinyHunters group over recent weeks. In these campaigns, employees at a well-known company are targeted with vishing calls impersonating the IT helpdesk or HR. They are then tricked into downloading an OAuth app or handing over their credentials outright. This allows the attackers to access the corporate Salesforce database, exfiltrate its contents and then hold it to ransom. Firms including LVMH, Chanel, Pandora, Adidas, Qantas, Google and Air France-KLM are among those to have had data compromised in this way. A recent ReliaQuest report pointed to a series of recently registered phishing domains as proof that financial services firms could be next on the target list. ShinyHunters has also been linked to the notorious Scattered Spider collective, which has been blamed for multiple ransomware attacks on UK retailers earlier this year. Image credit: Tada Images / Shutterstock.com

Human resources giant Workday has disclosed a data breach after attackers gained access to a third-party customer relationship management (CRM) platform in a recent social engineering attack. Headquartered in Pleasanton, California, Workday has over 19,300 employees in offices across North America, EMEA, and APJ. Workday's customer list comprises over 11,000 organizations across a diverse range of industries, including more than 60% of the Fortune 500 companies. As the company revealed in a Friday blog, the attackers gained access to some of the information stored on the compromised CRM systems, adding that no customer tenants were impacted. "We want to let you know about a recent social engineering campaign targeting many large organizations, including Workday," the HR giant said. "We recently identified that Workday had been targeted and threat actors were able to access some information from our third-party CRM platform. There is no indication of access to customer tenants or the data within them." However, some business contact information was exposed in the incident, including customer data that could be used in subsequent attacks. "The type of information the actor obtained was primarily commonly available business contact information, like names, email addresses, and phone numbers, potentially to further their social engineering scams," it added. In a separate notification sent to potentially affected customers and seen by BleepingComputer, the company added that the breach was discovered almost two weeks ago, on August 6. Workday added that the attackers contact employees via text or phone, pretending to be from Human Resources or IT, in an attempt to trick them into revealing account access or personal information. A Workday spokesperson referenced the company's Friday blog post when asked to confirm that the attackers breached a Salesforce instance and described the nature of the exposed information as "commonly available business contact information." Breached in Salesforce data-theft attacks While the company didn't directly confirm it, BleepingComputer has learned that the Workday incident is part of a wave of security breaches linked to the ShinyHunters extortion group, which targets Salesforce CRM instances through social engineering and voice phishing attacks. Multiple other high-profile companies worldwide were also recently breached in this campaign, including Adidas, Qantas, Allianz Life, Louis Vuitton, Dior, Tiffany & Co., Chanel, and, most recently, Google. These attacks are believed to have begun at the start of the year, with the threat actors tricking the targets' employees into linking a malicious OAuth app to their company's Salesforce instances through social engineering attacks. Once linked, the attackers use the connection to download and steal the companies' databases, with the stolen data later being used to extort the victims via email. The extortion demands were signed as coming from ShinyHunters, a notorious extortion group linked to numerous high-profile attacks over the years, including the Snowflake attacks and those against AT&T and PowerSchool. Update August 18, 05:39 EDT: Revised story and title after learning this was also a Salesforce data theft attack. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

An ongoing data extortion campaign targeting Salesforce customers could soon turn its attention to financial services firms, security experts have warned. The notorious ShinyHunters group has been blamed for a series of data breaches impacting big names in the fashion (LVMH, Chanel, Pandora, Adidas) and aviation (Qantas, Air France-KLM) sectors. These victims are typically targeted with vishing for logins to their Salesforce accounts and are sometimes also tricked into downloading a malicious app for similar purposes. However, ReliaQuest said today that its analysis of phishing domain names used in the group’s attacks points to a shift in targets. “Since July 2025, domain registrations targeting financial companies have increased by 12%, while targeting of technology firms has decreased by 5%,” the threat intelligence firm said. “This shift suggests that financially motivated groups like ShinyHunters are now prioritizing banks, insurance companies and financial services, though technology and professional services remain at high risk due to the value of the data and access they provide.” Some 700 of these domains have been registered in 2025, indicating the scale of the campaign. Are ShinyHunters and Scattered Spider the Same? Additionally, many, such as “company-okta[.]com” and “companyname-my-salesforce[.]com” match the same format as those used by the infamous Scattered Spider collective, said ReliaQuest. Many also share the same registry details, suggesting the groups are connected. The theory is backed by the appearance last year on BreachForums of a user calling themselves “Sp1d3rhunters,” who has reportedly claimed the two groups “are the same.” Both have ties to a nebulous movement dubbed “The Com,” which is characterized by English speaking teens and young adults, usually male, who have also veered into violence for hire, sextortion and online child abuse. The key for corporate security teams keen to avoid becoming the next victim is to focus on tactics, techniques and procedures (TTPs) rather than which group may be doing the attacking, said ReliaQuest. “Threat actors constantly rotate infrastructure, change names, and adapt their TTPs to evade detection and maximize impact. As a result, tracking the behavioral patterns and evolving TTPs behind these campaigns is far more valuable than focusing solely on indicators of compromise (IOCs) or attribution,” it argued. “For security leaders, understanding this fluid and persistent threat landscape is critical to anticipating future attacks and making informed decisions about security strategy and resource allocation.”

Connex, one of Connecticut's largest credit unions, warned tens of thousands of members that unknown attackers had stolen their personal and financial information after breaching its systems in early June. Founded in 1940, this member-owned organization is a non-profit with over $1 billion in assets, providing banking, insurance, and credit card services to more than 70,000 members across eight branches throughout the greater New Haven area, including New Haven, Hartford, Middlesex, and Fairfield counties. In data breach notification letters sent to affected individuals via U.S. Mail and filed with the office of Maine's Attorney General, Connex states that it discovered the incident on June 3, one day after its network was breached. "The investigation revealed that certain files may have been accessed or downloaded without authorization between June 2 and 3, 2025," it said. "On July 27, 2025, Connex identified certain individuals whose personal information may have been involved in the incident." The non-profit has yet to find evidence that the attackers gained access to the affected members' funds or accounts, but has discovered that they stole a combination of personal and financial data, including names, account numbers, debit card information, Social Security numbers, and government IDs. While the breach notification letters don't mention anything about the stolen data being used in attacks, Connex now displays a scam alert on its official websites, cautioning members of scammers impersonating its employees in ongoing phishing attacks. "Please be aware that scammers are calling/texting members impersonating Connex employees. Connex will never call you and ask for PINs, passcodes, or account numbers," Connex warns. "If you receive a suspicious call or text, hang up and call us directly at 1-800-CR-UNION (203-603-5700)." The disclosure comes on the heels of a wave of data breaches linked to the ShinyHunters extortion group, which targets Salesforce instances in vishing and social engineering attacks, impacting many high-profile companies, including Allianz Life, Adidas, Qantas, Louis Vuitton, Dior, Tiffany & Co., Chanel, and Google. The insurance sector has also been targeted by attacks linked to the Scattered Spider hacker collective, which has shifted its focus to aviation firms and retail companies in recent months. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Google has confirmed that it is among the victims of an ongoing data theft campaign targeting Salesforce instances. The tech giant confirmed that data has been retrieved by the threat actor, however this was largely publicly available business information, such as business names and contact details. The cyber-attack has been linked to ShinyHunters, tracked by the Google Threat Intelligence Group (GTIG) as UNC6040 and UN6240. In a blog update published on August 5, Google said, “Google responded to the activity, performed an impact analysis and began mitigations. The instance was used to store contact information and related notes for small and medium businesses.” ShinyHunters is a financially motivated threat cluster that specializes in voice phishing (vishing) campaigns specifically designed to compromise organizations' Salesforce instances for large-scale data theft and subsequent extortion. The vishing campaigns aim to trick victims into handing over login details and MFA codes. ShinyHunters Preparing for Escalation GTIG has warned that the threat actors using the ShinyHunters brand may be preparing to escalate their extortion tactics by launching a data leak site. At the moment, their extortion tactics involve calls or emails to employees of the victim organization demanding payment in bitcoin within 72 hours. A new leak site will increase pressure on victims, including those impacted by recent Salesforce-related data breaches. William Wright, CEO of Closed Door Security, commented, “ShinyHunters has recently executed a huge volume of attacks via Salesforce and it is essential organizations take note of these. The threat actors have also claimed many attacks are still unreported, so we can expect more victims to be announced in coming weeks.” Chanel and Pandora disclosed breaches of customer data linked to the ShinyHunters activity in early August 2025. Other companies suspected to have been victimized in a similar way by ShinyHunters include Allianz Life, Adidas, Qantas and several LVMH brands. Image credit: bluestork / Shutterstock.com

Air France and KLM are notifying some customers that their personal information may have been obtained by hackers following unauthorized access to a third-party platform used by the airlines. According to the companies, the unnamed platform is used for customer service and the hackers gained access to data such as first and last name, contact details, service request email subject lines, and Flying Blue loyalty program numbers. More sensitive information such as passwords, passports, credit card information, travel details, or Flying Blue miles has not been compromised. However, the airlines have warned customers to be on the lookout for email and phone phishing attempts. KLM is based in the Netherlands and Air France is based in France, but they are part of the same airline group. The companies have reported the incident to the data protection authorities in their respective countries. While no additional details have been provided by KLM and Air France, it’s worth noting that several major companies reported recently that hackers obtained their data after breaching a third-party customer relationship management (CRM) system. According to Bleeping Computer, the attacks all seem to be part of a campaign targeting Salesforce instances. A hacker group named ShinyHunters claims to be behind the attacks, and some links have also been found to the Scattered Spider cybercrime group. According to some reports, the two groups may have merged. The cybersecurity community recently warned airlines that Scattered Spider had started targeting this sector. The Salesforce attacks do not involve exploitation of any vulnerability or access to the vendor’s systems. Instead, the hackers are using phishing and social engineering to gain access to targeted instances. The list of major companies that appear to have been hit by the campaign includes Google, Adidas, Allianz Life, Cisco, Dior and Louis Vuitton. Related: Over 1 Million Impacted by DaVita Data Breach Related: Cost of Data Breach in US Rises to $10.22 Million, Says Latest IBM Report Related: Tea App Takes Messaging System Offline After Second Security Issue Reported

At the heart of multiple data breaches against sophisticated and robust companies, including Google, Adidas, Louis Vuitton, and Chanel, was a rudimentary attack method that required little technical finesse—making a phone call. By disguising themselves as IT support personnel on the phone, hackers belonging to the group “ShinyHunters” successfully tricked the employees at several multinational corporations into handing over the data within their own Salesforce platforms. The attacks underscore the vulnerability that all businesses face—large or small—in preventing cyberattacks that begin through basic social engineering scams. In a bizarre twist of irony, security researchers at Google Threat Intelligence Group (GITG) originally uncovered the hacking campaign in June, only to announce that Google itself had been hit by the very same tactic this week. Other victims in the hacking campaign include Allianz Life, the airline Qantas, and the jeweler Pandora. The data breaches all leverage a Salesforce feature that allows users to connect to various, external apps. This functionality allows business owners and employees to, for instance, connect their Salesforce data to mapping tools to visualize the locations of a customer base, or to connect their Salesforce data with a newsletter platform to deliver email marketing campaigns to specific customer segments. In the attacks, the hackers trick employees into connecting to a fraudulent version of Salesforce’s “Data Loader” app, which lets users import, export, update, and delete large quantities of data that are stored or managed within Salesforce itself. The process for connecting to an external app is simple, as employees just enter an 8-digit code when prompted by Salesforce. But once ensnared in the phone scam, employees are tricked into entering an 8-digit code that will connect to a data exfiltration program owned and operated entirely by the hackers. Once connected, the hackers are free to roam inside the company’s Salesforce data and steal what they see fit. Some attacks reportedly included an expansion by the hackers into other corporate online accounts, including Microsoft 365, which could reveal a company’s emails and other sensitive messages. In the attack against Google, the hackers accessed a Salesforce “instance,” which is a term used to describe a company or user’s implementation of software and the data they manage through that software (Think of it like when a hacker breaches an online account and then pilfers all the data related to that account and what it can access). In the Google attack, the Salesforce instance “was used to store contact information and related notes for small and medium businesses.” “Analysis revealed that data was retrieved by the threat actor during a small window of time before the access was cut off,” Google said. “The data retrieved by the threat actor was confined to basic and largely publicly available business information, such as business names and contact details.” According to the outlet Bleeping Computer, the ShinyHunters cybercrime group is still stealing business data through this attack campaign. Once the hackers have the data, they then extort the victims to pay a hefty ransom or risk having the data exposed online. How to stay safe from the Salesforce scam Because this attack is so targeted—every corporate victim uses Salesforce—the defense strategies are clear and actionable. Here’s how you can help yourself and your staff in avoiding this attack. Audit your Salesforce access. Ensure that the only employees or staff who have access to Salesforce are those who need to use it for their job. When there are fewer employees who can access Salesforce, there are fewer entry points for hackers. Train your staff. Recognizing a social engineering scam is important for any workforce, no matter the size. Inform your employees and yourself about your current IT support provider so that any rogue phone calls are immediately caught. Use multifactor authentication (MFA) for important accounts. The hackers in these attacks managed to gain access to other cloud applications like Microsoft 365. Protect all your employee accounts on sensitive platforms with MFA. Social engineering scams are some of the most effective and serious threats to small businesses. It’s important to recognize them when they happen. And for all else, use always-on cybersecurity to protect your business from malware, viruses, and nefarious break-in attempts.

Air France and KLM announced on Wednesday that attackers had breached a customer service platform and stolen the data of an undisclosed number of customers. Together with Transavia, Air France and KLM are part of Air France–KLM Group, a French-Dutch multinational airline holding company founded in 2004 and a major player in international air transport. With a fleet of 564 aircraft and 78,000 employees, Air France-KLM provides services to up to 300 destinations in 90 countries. In 2024, the aviation group transported 98 million passengers worldwide. The two airlines stated that they've cut off the attackers' access to the compromised systems after discovering the breach and added that their networks were not affected by the attack. "Air France and KLM have detected unusual activity on an external platform we use for customer service. This activity resulted in unauthorized access to customer data," they said. "Our IT security teams, along with the relevant external party, took immediate action to stop the unauthorized access. Measures have also been implemented to prevent recurrence. Internal Air France and KLM systems were not affected." While the attackers gained access to customer data, such as names, email addreses, phone numbers, rewards program information, and latest transactions, Air France and KLM said that the customers' financial and personal information was not affected. The airlines have also notified relevant authorities in their countries of the incident and are now also alerting impacted individuals that their data was stolen. "KLM has reported the incident to the Dutch Data Protection Authority; Air France has done so in France with the CNIL," they added. "Customers whose data may have been accessed are currently being informed and advised to be extra vigilant for suspicious emails or phone calls." Salesforce data theft attacks BleepingComputer has learned that this incident is part of a wave of data breaches linked to the ShinyHunters extortion group, which targets Salesforce instances in vishing and social engineering attacks. Multiple other high-profile companies, including Adidas, Qantas, Allianz Life, Louis Vuitton, Dior, Tiffany & Co., Chanel, and, most recently, Google, were also recently breached in this campaign. An Air France–KLM spokesperson stated that the company would not provide additional information due to an ongoing investigation when asked by BleepingComputer to confirm whether the data was stolen from a compromised Salesforce instance and disclose the number of individuals affected. The Air France–KLM incident also comes on the heels of other aviation breaches linked to the Scattered Spider hacker collective, which has shifted its focus to aviation and transportation firms in recent months, breaching WestJet and Hawaiian Airlines after previously targeting the insurance and retail sectors. Update August 07, 08:00 EDT: Added Air France–KLM statement. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Google revealed on Tuesday that one of its corporate Salesforce instances was targeted by threat actors. The attack appears to be part of a campaign that has hit several major companies. The tech giant said its Salesforce instance was targeted in June and attributed the activity to a threat group tracked as UNC6040. Google said the hackers obtained contact information and related notes for small and medium businesses from the compromised environment. “Analysis revealed that data was retrieved by the threat actor during a small window of time before the access was cut off,” Google explained. “The data retrieved by the threat actor was confined to basic and largely publicly available business information, such as business names and contact details.” Google warned in early June that UNC6040, a threat actor specializing in voice phishing, had targeted Salesforce customers in a large-scale data theft and extortion campaign. Google reported at the time that it had found links to the notorious cybercrime groups Scattered Spider and ShinyHunters. The attack on its own Salesforce instance was disclosed in an update to the blog post describing the UNC6040 attacks, and the company has now reiterated the apparent link to ShinyHunters. According to the tech giant, UNC6040 is responsible for the initial intrusion, while a different activity cluster, tracked as UNC6240, is responsible for extortion attempts, which sometimes are initiated months after the initial data theft. “The extortion involves calls or emails to employees of the victim organization demanding payment in bitcoin within 72 hours. During these communications, UNC6240 has consistently claimed to be the threat group ShinyHunters,” Google said. “In addition, we believe threat actors using the ‘ShinyHunters’ brand may be preparing to escalate their extortion tactics by launching a data leak site (DLS). These new tactics are likely intended to increase pressure on victims, including those associated with the recent UNC6040 Salesforce-related data breaches,” it added. Bleeping Computer reported — based on information from ShinyHunters — that the recent data breaches disclosed by Adidas, Allianz Life, Cisco, Dior, Louis Vuitton and others are the result of the same Salesforce hacking campaign. Jewelry store Pandora also disclosed a data breach this week and the company was reportedly a target of the same campaign. Salesforce pointed out that its systems have not been compromised and the attacks do not exploit any vulnerability in its platform. The company suggested that the recent attacks are the result of sophisticated phishing and other social engineering attacks targeting its customers. DataBreaches reported recently that ShinyHunters appears to have merged with Scattered Spider. Several alleged members of both ShinyHunters and Scattered Spider have been arrested over the past year. Related: Over 1 Million Impacted by DaVita Data Breach Related: NASCAR Confirms Personal Information Stolen in Ransomware Attack

Google is the latest company to suffer a data breach in an ongoing wave of Salesforce CRM data theft attacks conducted by the ShinyHunters extortion group. In June, Google warned that a threat actor they classify as 'UNC6040' is targeting companies' employees in voice phishing (vishing) social engineering attacks to breach Salesforce instances and download customer data. This data is then used to extort companies into paying a ransom to prevent the data from being leaked. In a brief update to the article last night, Google said that it too fell victim to the same attack in June after one of its Salesforce CRM instances was breached and customer data was stolen. "In June, one of Google's corporate Salesforce instances was impacted by similar UNC6040 activity described in this post. Google responded to the activity, performed an impact analysis and began mitigations," reads Google's update. "The instance was used to store contact information and related notes for small and medium businesses. Analysis revealed that data was retrieved by the threat actor during a small window of time before the access was cut off." "The data retrieved by the threat actor was confined to basic and largely publicly available business information, such as business names and contact details." Google is classifying the threat actors behind these attacks as 'UNC6040' or 'UNC6240.' However, BleepingComputer, which has been tracking these attacks, has learned that a notorious threat actor known as ShinyHunters is behind the attacks. ShinyHunters has been around for years, responsible for a wide range of breaches, including those at PowerSchool, Oracle Cloud, the Snowflake data-theft attacks, AT&T, NitroPDF, Wattpad, MathWay, and many more. In a conversation with BleepingComputer yesterday, ShinyHunters claimed to have breached many Salesforce instances, with attacks still ongoing. The threat actor claimed yesterday to BleepingComputer that they breached a trillion-dollar company, and were considering just leaking the data rather than attempting to extort them. It is unclear if this company is Google. As for the other companies impacted in these attacks, the threat actor is extorting them through email, demanding they pay a ransom to prevent the data from being publicly leaked. Once the threat actor has finished privately extorting companies, they plan to publicly leak or sell data on a hacking forum. BleepingComputer has learned of one company that has already paid 4 Bitcoins, or approximately $400,000, to prevent the leak of their data. Other companies impacted in these attacks include Adidas, Qantas, Allianz Life, Cisco, and the LVMH subsidiaries Louis Vuitton, Dior, and Tiffany & Co. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

Chanel and Pandora have become the latest fashion giants to disclose breaches of customer data, in what appear to be attacks on their Salesforce accounts. Danish jewelry retailer Pandora began notifying customers of the incident this week, according to screenshots posted to Reddit. “We are writing to inform you that your contact information was accessed by an unauthorized party through a third-party platform we use,” the notice read. “We stopped the access and have further strengthened our security measures.” According to the message, only names, birthdates and emails were impacted, with no financial data or passwords stolen. However, this still represents a potentially major security risk for customers, according to Mark Weir, regional director of UK and Ireland at Check Point Software. “This breach may involve only names, emails and birthdates, but that’s enough for phishing, credential stuffing and synthetic identity fraud. In cyber terms, this is a strong starting point for more serious attacks,” he warned. “The attack came via a third-party platform – a common weak link in retail ecosystems. These integrations often lack visibility, yet when they’re breached, there’s no guarantee all affected customers will be told.” Separately, Chanel informed its US customers of an incident it discovered on July 25, according to screenshots posted on X (formerly Twitter). “Chanel became aware of a security incident involving a Chanel, Inc. database in the US hosted by a third-party service provider, where an unauthorized external party accessed and obtained some of the client data we hold,” it revealed. “There was no malware deployed to our systems, and our operations remain unaffected.” This time, the breach involved names, email and home addresses, and phone numbers. ShinyHunters the Prime Suspect Although the firms have yet to reveal any further details, suspicion is mounting that the attacks could be part of an ongoing data extortion campaign by the ShinyHunters (UNC6040) group. This was first flagged in June by Google Threat Intelligence, which revealed that the actors use voice phishing (vishing) techniques to trick employees into believing they are calling from IT. The actors then persuade the victims into handing over their Salesforce credentials and MFA tokens, or adding a malicious version of Salesforce’s Data Loader app, to gain access to their customer database. In an update yesterday, Google said the group has now shifted to using Python scripts that perform a similar function to the Data Loader app, as well as TOR IPs to obfuscate their location. Google added that the group, which has been linked to Scattered Spider/The Com, “may be preparing to escalate their extortion tactics by launching a data leak site.” The tech giant also revealed that one of its own Salesforce instances had been breached by UNC6040 “for a small window of time.” It claimed that the exfiltrated data “was confined to basic and largely publicly available business information, such as business names and contact details.” Other companies suspected to have been victimized in a similar way by ShinyHunters include Allianz Life, Adidas, Qantas and several LVMH brands. “It is now evident that every company with a Salesforce/CRM presence is a potential target, and threat actors use highly convincing phone and email lures, and do not rely on technical exploits – making staff the primary attack vector,” argued ColorTokens chief evangelist, Agnidipta Sarkar. “In my opinion, apart from building awareness of outsourced helpdesks and support staff, cybersecurity leaders should immediately invest in technologies to reduce lateral movement, heavily restrict which employees can install or approve new Salesforce apps, use strict RBAC [role-based access] controls and microsegment cloud instances, enforce digital certificate-based passwordless authentication and continuously monitor the critical digital assets for anomalous and malicious behavior.” Image credit: Creative Lab / Shutterstock.com

Danish jewelry giant Pandora has disclosed a data breach after its customer information was stolen in the ongoing Salesforce data theft attacks. Pandora is one of the largest jewellery brands in the world, with 2,700 locations and over 37,000 employees. "We are writing to inform you that your contact information was accessed by an unauthorized party through a third-party platform we use," reads a Pandora data breach notification sent to customers. "We stopped the access and have further strengthened our security measures." As first reported by Forbes, only customers' names, birthdates, and email addresses were stolen in the attack. Passwords, IDs, and financial information were not exposed. While Pandora has not shared the name of the third-party platform, BleepingComputer has learned that the data was stolen from the company's Salesforce database. Since at least January 2025, if not earlier, threat actors have been conducting social engineering and phishing campaigns targeting companies' employees and help desks. These attacks are designed to steal Salesforce credentials or trick employees into authorizing a malicious OAuth application to their Salesforce account. Using this access, the threat actors download and steal the company's Salesforce database, which is then used to extort the company into paying a ransom to prevent the data from being leaked. ShinyHunters confirmed to BleepingComputer that they are privately extorting companies and will perform a mass sale or leak of companies that do not pay a ransom in the future, like they did in the Snowflake data-theft attacks. The threat actor also confirmed that the attacks are ongoing, so all companies should review Salesforce's recommendations on hardening their accounts. "Salesforce has not been compromised, and the issues described are not due to any known vulnerability in our platform. While Salesforce builds enterprise-grade security into everything we do, customers also play a critical role in keeping their data safe — especially amid a rise in sophisticated phishing and social engineering attacks," Salesforce told BleepingComputer. "We continue to encourage all customers to follow security best practices, including enabling multi-factor authentication (MFA), enforcing the principle of least privilege, and carefully managing connected applications. For more information, please visit: https://www.salesforce.com/blog/protect-against-social-engineering/." Other companies impacted in these attacks include Adidas, Qantas, Allianz Life, and the LVMH subsidiaries Louis Vuitton, Dior, and Tiffany & Co. However, BleepingComputer has been told that there are many more that remain undisclosed. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

French fashion giant Chanel is the latest company to suffer a data breach in an ongoing wave of Salesforce data theft attacks. Chanel says the breach was first detected on July 25th after threat actors gained access to a Chanel database hosted at a third-party service provider, as first reported by WWD. The breach only impacted customers in the United States and exposed personal contact information. "Based on the findings of the investigation, the data obtained by the unauthorized external party contained limited details of a subset of individuals who contacted our client care center in the U.S. —specifically name, email address, mailing address and phone number," a Spokesperson told WWD. "No other information was contained in the database. The clients affected have been informed." While Chanel has not replied to our emails and the name of the third-party service provider was not mentioned, BleepingComputer has learned that it was stolen from the company's Salesforce instance. This attack has been attributed to the ongoing wave of Salesforce data-theft attacks conducted by the ShinyHunters extortion group. As first reported by Mandiant, threat actors have been actively targeting Salesforce customers in vishing (voice phishing) attacks to compromise credentials or to trick employees into authorizing a malicious OAuth app with their organization's Salesforce portal. Once they gain access to the Salesforce instance, they exfiltrate the database and use it as leverage in extortion demands on customers. In a statement to BleepingComputer, Salesforce emphasized that its platform was not compromised, but rather, customers' accounts are being breached in social engineering attacks. "Salesforce has not been compromised, and the issues described are not due to any known vulnerability in our platform. While Salesforce builds enterprise-grade security into everything we do, customers also play a critical role in keeping their data safe — especially amid a rise in sophisticated phishing and social engineering attacks," Salesforce told BleepingComputer. "We continue to encourage all customers to follow security best practices, including enabling multi-factor authentication (MFA), enforcing the principle of least privilege, and carefully managing connected applications. For more information, please visit: https://www.salesforce.com/blog/protect-against-social-engineering/." The threat actors have not publicly leaked the data for any companies to date, with companies currently extorted via email. Other companies impacted in these Salesforce data theft attacks include Adidas, Qantas, Allianz Life, and the LVMH brands, Louis Vuitton, Dior, and Tiffany & Co. BleepingComputer knows of other allegedly breached companies that have not yet disclosed attacks, but we have not been able to verify them independently as of yet. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report

A wave of data breaches impacting companies like Qantas, Allianz Life, LVMH, and Adidas has been linked to the ShinyHunters extortion group, which has been using voice phishing attacks to steal data from Salesforce CRM instances. In June, Google's Threat Intelligence Group (GTIG) warned that threat actors tracked as UNC6040 were targeting Salesforce customers in social engineering attacks. In these attacks, the threat actors impersonated IT support staff in phone calls to targeted employees, attempting to persuade them into visiting Salesforce's connected app setup page. On this page, they were told to enter a "connection code", which linked a malicious version of Salesforce's Data Loader OAuth app to the target's Salesforce environment. In some cases, the Data Loader component was renamed to "My Ticket Portal," to make it more convincing in the attacks. GTIG says that these attacks were usually conducted through vishing (voice phishing), but credentials and MFA tokens were also stolen through phishing pages that impersonated Okta login pages. Around the time of this report, multiple companies reported data breaches involving third-party customer service or cloud-based CRM systems. LVMH subsidiaries Louis Vuitton, Dior, and Tiffany & Co. each disclosed unauthorized access to a customer information database, with Tiffany Korea notifying customers the attackers breached a "vendor platform used for managing customer data." Adidas, Qantas, and Allianz Life also reported breaches involving third-party systems, with Allianz confirming it was a third-party customer relationship management platform. "On July 16, 2025, a malicious threat actor gained access to a third-party, cloud-based CRM system used by Allianz Life Insurance Company of North America (Allianz Life)," an Allianz Life spokesperson told BleepingComputer. While BleepingComputer has learned that the Qantas data breach also involved a third-party customer relationship management platform, the company will not confirm it is Salesforce. However, previous reporting from local media claims the data was stolen from Qantas' Salesforce instance. Furthermore, court documents state that the threat actors targeted "Accounts" and "Contacts" database tables, both of which are Salesforce objects. While none of these companies have publicly named Salesforce, BleepingComputer has since confirmed that all were targeted in the same campaign detailed by Google. The attacks have not led to public extortion or data leaks yet, with BleepingComputer learning that the threat actors are attempting to privately extort companies over email, where they name themselves as ShinyHunters. It is believed that when these extortion attempts fail, the threat actors will release stolen information in a long wave of leaks, similar to ShinyHunter's previous Snowflake attacks. "We have not identified any data leak sites associated with this activity," Genevieve Stark, Head of Cybercrime, and Information Operations Intelligence Analysis at GTIG, told BleepingComputer. "It is plausible that the threat actor intends to sell the data instead of sharing it publicly. This approach would align with prior ShinyHunters Group activity." Google say they are now tracking Salesforce data-theft attacks under multiple threat group designations. "GTIG attributes multiple incidents impacting Salesforce instances to UNC6040. In at least some cases, the follow-on extortion activity, which we attribute to the distinct threat cluster UNC6240, has used the ShinyHunters brand," Stark told BleepingComputer. "The extortion activity is attributed to UNC6240 instead of UNC6040 due to a significant time gap between the initial data theft activity and the subsequent extortion activity. We have not confirmed the nature of the relationship between these intrusions and the prior use of this handle on underground forums." Who is ShinyHunters The breaches have caused confusion among the cybersecurity community and the media, including BleepingComputer, with the attacks attributed to Scattered Spider (tracked by Mandiant as UNC3944), as those threat actors were also targeting the aviation, retail, and insurance sectors around the same time and demonstrated similar tactics. However, threat actors associated with Scattered Spider tend to perform full-blown network breaches, culminating with data theft and, sometimes, ransomware. ShinyHunters, tracked as UNC6040, on the other hand, tends to focus more on data-theft extortion attacks targeting a particular cloud platform or web application. It is BleepingComputer's and some security researchers' belief that both UNC6040/UNC6240 and UNC3944 consist of overlapping members that communicate within the same online communities. The threat group is also believed to overlap with "The Com," a network of experienced English-speaking cybercriminals. "According to Recorded Future intelligence, the overlapping TTPs between known Scattered Spider and ShinyHunters attacks indicate likely some crossover between the two groups," Allan Liska, an Intelligence Analyst for Recorded Future, told BleepingComputer. Other researchers have told BleepingComputer that ShinyHunters and Scattered Spider appear to be operating in lockstep, targeting the same industries at the same time, making it harder to attribute attacks. Some also believe that both groups have ties to threat actors from the now-defunct Lapsus$ hacking group, with reports indicating that one of the recently arrested Scattered Spider hackers was also in Lapsus$. Another theory is that ShinyHunters is acting as an extortion-as-a-service, where they extort companies on behalf of other threat actors in exchange for a revenue share, similar to how ransomware-as-a-service gangs operate. This theory is supported by previous conversations BleepingComputer has had with ShinyHunters, where they claimed not to be behind a breach, but just acting as the seller of the stolen data. These breaches include PowerSchool, Oracle Cloud, the Snowflake data-theft attacks, AT&T, NitroPDF, Wattpad, MathWay, and many more. To muddy the waters further, there have been numerous arrests of people linked to the name "ShinyHunters," including those who have been arrested for the Snowflake data-theft attacks, breaches at PowerSchool, and the operation of the Breached v2 hacking forum. Yet even after these arrests, new attacks occur with companies receiving extortion emails stating, "We are ShinyHunters," referring to themselves as a "collective." Protecting Salesforce instances from attacks In a statement to BleepingComputer, Salesforce emphasized that the platform itself was not compromised, but rather, customers' accounts are being breached via social engineering. "Salesforce has not been compromised, and the issues described are not due to any known vulnerability in our platform. While Salesforce builds enterprise-grade security into everything we do, customers also play a critical role in keeping their data safe — especially amid a rise in sophisticated phishing and social engineering attacks," Salesforce told BleepingComputer. "We continue to encourage all customers to follow security best practices, including enabling multi-factor authentication (MFA), enforcing the principle of least privilege, and carefully managing connected applications. For more information, please visit: https://www.salesforce.com/blog/protect-against-social-engineering/." Salesforce is urging customers to strengthen their security posture by: Enforcing trusted IP ranges for logins Following the principle of least privilege for app permissions Enabling multi-factor authentication (MFA) Restricting use of connected apps and managing access policies Using Salesforce Shield for advanced threat detection, event monitoring, and transaction policies Adding a designated Security Contact for incident communication Further details on these mitigations can be found in Salesforce's guidance linked above. Update 8/1/25: Added information from GTIG. Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply. The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments. Get the report