Salesforce Refuses to Pay Extortion Demand After 1 Billion Records Breach
In a bold move, Salesforce has announced that it will not pay an extortion demand made by a crime syndicate claiming to have stolen approximately 1 billion records from dozens of its customers. The threat group, known as Scattered LAPSUS Hunters, began its campaign in May, targeting organizations using the Salesforce platform.
According to Mandiant, a cybersecurity firm owned by Google, the attackers made voice calls to their targets, providing a pretext that necessitated the connection of an attacker-controlled app to their Salesforce portal. "It's becoming a real mess," said a source close to the matter. "Many of the people who received the calls complied, which is surprising but not unexpected."
The Scattered LAPSUS Hunters group is a mashup of three prolific data-extortion actors: Scattered Spider, LAPSuS, and ShinyHunters. Mandiant tracks the group as UNC6040 due to the researchers' inability to positively identify their connections.
Earlier this month, the group created a website naming 40 Salesforce customers whose data was stolen in the campaign, including Toyota and FedEx. The website also included a ransom demand for an unspecified amount of money.
Salesforce has refused to pay the extortion demand, citing its commitment to protecting customer data. "We take the security of our customers' data extremely seriously," said a spokesperson for the company. "We will not engage in any form of negotiation or payment with these attackers."
The breach highlights the growing threat of data-extortion attacks and the importance of robust cybersecurity measures. As more organizations rely on cloud-based platforms like Salesforce, the risk of data breaches increases.
"This attack is a wake-up call for companies to review their security protocols and ensure they are prepared for such threats," said a cybersecurity expert. "The fact that many targets complied with the attackers' demands suggests a lack of awareness about these types of attacks."
The current status of the breach remains unclear, but Salesforce has assured its customers that it is working closely with law enforcement agencies to investigate the incident and prevent further breaches.
As the situation unfolds, one thing is clear: the threat of data-extortion attacks will continue to evolve, and organizations must stay vigilant in protecting their sensitive information.
*Reporting by Arstechnica.*
