Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

The Golden Scale: Notable Threat Updates and Looking Ahead

Summary: Unit 42 reports that Scattered LAPSUS$ Hunters, the syndicate behind the Salesforce data theft extortion activity, set a ransom deadline of 11:59 PM ET on Oct. 10, 2025, after which news reports indicated stolen data allegedly belonging to six companies in aviation, energy and retail was leaked, including PII such as names, dates of birth, email addresses, phone numbers and frequent flyer numbers. On Oct. 10 the group alluded to launching an extortion-as-a-service program modeled on RaaS but with no file encryption, and on Oct. 5 posted an advertisement seeking insider access at call centers, gaming companies, hosting providers, SaaS and telecom organizations in the U.S., UK, Australia, Canada and France.

Why it matters: The group's stated intent to drop file encryption removes the operational disruption that has historically driven ransom payments, so the leverage shifts to reputational harm from leaked PII - including frequent flyer numbers that Unit 42 says can fuel identity theft and fraudulent travel agencies. Unit 42's recommendation is that organizations build EaaS-specific playbooks, with third-party negotiators and data-verification experts on retainer, alongside their existing ransomware plans.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Data Breaches
Related