Hackers claim major data breach targeting Salesforce users via UK retailers

Salesforce denied any breach of its platform, but the hacker group claims it exploited users through voice phishing and tricked support staff into installing a tampered tool that allowed large-scale data extraction from client systems

A cybercriminal group calling itself Scattered LAPSUS$ Hunters has claimed responsibility for stealing nearly one billion records by targeting companies that use Salesforce software. The group, reportedly connected to the broader LAPSUS$ cybercrime network, says it accessed vast amounts of personal data through social engineering tactics rather than a direct breach of Salesforce’s systems.

Salesforce, a leading U.S. cloud services provider, has denied any compromise of its platform. A spokesperson stated there is “no indication” of a breach in their technology or any known vulnerabilities being exploited. However, the group claims it exploited Salesforce users through techniques like vishing—a form of voice phishing—and tricked customer support staff into installing malicious tools, including a tampered version of Salesforce’s Data Loader, which enabled bulk data extraction.

Major retailers and the dark web leak

The group also claims responsibility for earlier cyberattacks on British retailers including Marks & Spencer, Co-op, and Jaguar Land Rover, and has posted a leak site on the dark web listing over 40 organisations it claims to have breached. It remains unclear whether all of these entities are actual Salesforce customers, and the authenticity of the stolen “billion-record” cache has not been independently verified.

Links to larger cybercrime ecosystems

Security analysts say the group is tracked by Google’s Threat Intelligence team under the designation UNC6040, and note that its infrastructure may overlap with “The Com,” a loosely organised cybercriminal network involved in both digital and physical criminal activity. The tactics of Scattered LAPSUS$ Hunters mirror those of earlier LAPSUS$ operations, which often relied on manipulating employees rather than exploiting technical flaws.

Ongoing investigations

In July, British authorities arrested four individuals under the age of 21 in connection with earlier retail cyberattacks. It remains unclear whether those arrests are directly linked to the latest data theft claims. Investigations by law enforcement and cybersecurity experts are ongoing.