Follow us on Google News
Global cloud software giant Salesforce has issued a firm statement to the hacker group ShinyHunters, confirming that it will not pay the ransom demanded by the group. ShinyHunters claims to have stolen sensitive customer data, some of which has already been posted online. The group is also reportedly linked to other cybercrime networks, including Scattered LAPSUS$ Hunters.
FCRF Launches CCLP Program to Train India’s Next Generation of Cyber Law Practitioners
Salesforce emphasized that its core platform remains fully secure. The company stated that the breach did not involve a direct attack on its systems, but rather exploited vulnerabilities in customer security practices. Salesforce also assured affected clients that it is providing guidance and support to help mitigate the impact.
Salesforce’s Response and Strategy
- Refusal to Pay Ransom: Salesforce informed affected customers that it will not engage in ransom negotiations or make any payments. The company maintains that paying would only encourage further attacks.
- Verified Threat Intelligence: In an email sent on October 7, 2025, Salesforce said it has received credible threat intelligence indicating that hackers plan to publish more of the stolen data online.
- Supporting Customers: Salesforce stated that it remains in close contact with affected clients, offering guidance to strengthen data security measures and protect against potential threats.
- Focus on Customer-Side Weaknesses: The company reiterated that the breach was caused by vulnerabilities in customer security practices, not any flaw in Salesforce’s platform.
How the Data Was Stolen
Hackers primarily relied on social engineering and exploiting third-party applications to access sensitive data.
Social Engineering Attacks
- Voice Phishing (Vishing): A hacker known as “Shiny” told Reuters that the group used voice phishing to deceive employees, impersonating IT help desks to gain access to customer data.
- Malicious Apps: Employees were persuaded to install modified versions of legitimate Salesforce apps like Data Loader, which allowed attackers to extract large volumes of data. Google’s Threat Intelligence Group had issued warnings about such campaigns as early as June 2025.
Third-Party App Vulnerabilities
- SalesLoft Drift Integration: In August 2025, hackers exploited compromised OAuth tokens from the third-party app SalesLoft Drift, which integrates with Salesforce, gaining access to data from hundreds of customer organizations.
- Stolen Credentials: Attackers also collected sensitive credentials, including Amazon Web Services (AWS) access keys, passwords, and Snowflake tokens.
Implications and Accountability
Although Salesforce maintains that its platform remained secure, the incident has raised questions about its shared responsibility model and platform security. Critics argue that Salesforce’s architecture allowed large-scale data exports using compromised credentials without triggering sufficient security alerts.
For customers, the breach highlights the importance of:
- Regularly reviewing third-party app integrations,
- Implementing multi-factor authentication (MFA),
- Providing employees with robust training on social engineering and phishing risks.
Salesforce has indicated that it will further strengthen security monitoring and risk management measures, while continuing to guide and support customers.
The incident underscores that cloud security extends beyond the platform itself, relying heavily on customer-side practices and awareness. Experts stress that companies must prioritize third-party app integrations, employee training, and proactive monitoring to prevent similar cyberattacks in the future.
