Shiny Hunters Wage Broad Corporate Extortion Spree
Summary: ShinyHunters, tracked by Google as UNC6040, launched a victim-shaming site called Scattered LAPSUS$ Hunters listing more than three dozen companies - including Toyota, FedEx, Disney/Hulu and UPS - whose Salesforce data was stolen in a May 2025 voice phishing campaign, and set an October 10 deadline before publishing. The group also claimed the September breach of a Red Hat GitLab server holding more than 28,000 code repositories and over 5,000 Customer Engagement Reports, and Discord began notifying users affected by a September 20 incident at a third-party customer service provider.
Why it matters: Salesforce has stated it will not engage, negotiate with, or pay any extortion demand, while the group threatens to begin extorting hundreds more organizations whose authentication tokens were stolen from Salesloft in August - so the question is whether your own third-party integrations are inside that blast radius.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026