Follow us on Google News
A wave of coordinated cyber intrusions in 2025 has compromised the Salesforce environments of nearly 90+ organizations worldwide, impacting industries ranging from retail and luxury fashion to aviation, insurance, and technology. According to Google’s Threat Intelligence Group, the campaign relied entirely on social engineering rather than exploiting flaws in Salesforce’s infrastructure.
High-profile victims include Adidas, Cartier, Louis Vuitton, Dior, Chanel, Tiffany & Co., Google, Cisco, Qantas Airways, Air France–KLM, Pandora, and Allianz Life. The threat actors, identified as the financially motivated collective UNC6040 and often linked to ShinyHunters, claim to have exfiltrated sensitive data from 91 organizations.
Data Protection and DPDP Act Readiness: Hundreds of Senior Leaders Sign Up for CDPO Program
How the Breach Occurred
Investigators found that attackers impersonated corporate IT staff in targeted voice phishing calls, convincing employees to authorize malicious applications through Salesforce’s Connected Apps feature. Employees were directed to enter unique codes, unknowingly granting attackers OAuth permissions that bypassed multi-factor authentication.
With these permissions, the attackers used trojanized versions of Salesforce’s Data Loader tool or disguised apps such as “My Ticket Portal” to gain API-level access. This allowed them to query and export customer records, loyalty program details, and internal data at scale. In several cases, the compromised Salesforce accounts were later leveraged to infiltrate additional platforms, including Office 365.
The attackers escalated their extortion campaign by launching a Telegram channel called Scattered Lapsu$ Hunters, where they posted data samples, ransom chats, and threats of large-scale leaks unless victims paid cryptocurrency demands.
Attribution and Impact
Initially suspected to be linked to Scattered Spider due to similarities in tactics, the operations were later attributed to ShinyHunters. Google researchers cited infrastructure overlaps with earlier breaches tied to the group, including Snowflake incidents. Experts believe the campaign represents a collaboration between multiple cybercriminal outfits under a loosely affiliated “extortion-as-a-service” model.
The exposed data varied by company, ranging from customer contact information and loyalty records to shopping preferences and business contact lists. Notably, no financial account details or passwords were reported stolen. Organizations including Cartier, Chanel, Qantas, and Allianz Life confirmed breaches, initiated investigations, and notified regulators and customers.
The scale and persistence of the campaign highlight how human deception and misconfigured app permissions can undermine security in even the most trusted cloud platforms. Authorities in Europe and the United States continue to investigate.
