A serious security incident is occurring in the tech world as a notorious hacker group called Scattered LAPSUS$ Hunters claims responsibility for breaching data belonging to Salesforce and its customers. With nearly 1 billion records allegedly stolen and leaked samples already posted online, this could become one of the most significant data breaches in recent years.
On October 3, 2025, the hacker group launched a dark web site titled “Trinity of Chaos”, where they began publishing samples of stolen data. According to their claims, most of the compromised organizations are Salesforce customers, and they are demanding Salesforce pay a ransom before October 10, 2025 to avoid the full release of the data.
The group has warned that failure to negotiate will result in:
The breach includes an alarming list of 39 Salesforce customers and 3 other global companies, many of which are household names:
According to the group, the stolen data includes:
The nature of the data—containing personally identifiable information (PII)—means the breach could have serious compliance implications under laws such as GDPR, CCPA, and others.
“Salesforce ignored our previous warnings. Now, they must act or face the consequences,” the group wrote on their site.
The attackers are demanding direct negotiations with Salesforce, warning that if they don’t receive a response by October 10, 2025, they will:
The group refers to this as a “mutually beneficial opportunity”, framing it as the last chance to avoid catastrophic data exposure. They have also invited affected companies to contact them directly via email using company domains to verify identities and receive further instructions.
Data Samples Already Shared
The hackers have already posted data samples from several of the companies on the site to prove the legitimacy of their claims. The data includes actual customer records, internal CRM information, and user details.
They’ve also claimed that if Salesforce refuses to negotiate, they will:
Avoid targeting organizations previously impacted in their past campaigns (UNC6395 and UNC6040)—but only if they now choose to cooperate
The Scattered LAPSUS$ Hunters group released a new statement on October 6, intensifying pressure:
The group insists the only resolution is direct negotiation, giving Salesforce and victims until October 10 to respond.
This incident highlights a vital truth: third-party risk in SaaS ecosystems can be as dangerous as direct breaches. While it’s still unclear whether Salesforce was directly compromised or if its customer integrations were the main attack vector, the scale and sophistication of this attack make it a pivotal moment for cloud security in 2025. With the October 10 ransom deadline now here, time is running out. The world is watching to see how Salesforce and the affected companies respond.
