Hackers claim 1B records from Salesforce customers, threaten ransom

A hacker collective calling itself Scattered LAPSUS Hunters this week published a dark web data-leak site claiming to have stolen roughly 1 billion records from 39 companies that use Salesforce, and demanded ransom negotiations by Oct. 10, 2025, to avoid public disclosure. The list published by the group includes major brands across technology, retail, aviation and finance, and the operators posted samples and estimated volumes and dates for each alleged compromise.

Security researchers and affected organizations say the thefts did not stem from a vulnerability in Salesforce's core platform but from attacks on customer environments and third-party integrations. Investigations by Salesforce with external experts and authorities, Salesforce said, indicate the reported extortion “relate to past or unsubstantiated incidents,” and that “at this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology.” Salesforce said it is engaged with affected customers and advising vigilance against phishing and social engineering.

Researchers have traced the campaign to tactics including voice...