Cybercriminals linked to a wave of ransomware incidents targeting British retailers have claimed responsibility for stealing almost one billion records from US cloud technology giant Salesforce. The group, calling itself Scattered LAPSUS$ Hunters, told Reuters on Friday that it had obtained vast troves of personal information by exploiting companies that rely on Salesforce software.<\/p>\n
Who are the hackers?<\/p>\n
The group, an apparent offshoot of the wider LAPSUS$ cybercrime network<\/a>, said it was behind recent breaches at Marks & Spencer, the Co-op and Jaguar Land Rover earlier this year. Security experts say it is tracked under the designation UNC6040 by Google\u2019s Threat Intelligence Group, which has previously warned of its social-engineering tactics.<\/p>\n How the data was allegedly stolen<\/p>\n Salesforce denied its systems had been compromised. Instead, one hacker, who identified themselves as \u201cShiny,\u201d<\/a> said the operation used vishing, voice phishing calls to IT help desks, to trick employees of Salesforce customers. In some cases, attackers reportedly persuaded staff to install a tampered version of Salesforce\u2019s Data Loader tool, allowing bulk extraction of information.<\/p>\n What was leaked?<\/p>\n On Friday, Scattered LAPSUS$ Hunters launched a dark web<\/a> leak site listing around 40 organisations it claimed to have breached. The authenticity of the alleged billion-record haul remains unverified, and it is unclear whether all of the companies cited are Salesforce clients.<\/p>\n Salesforce\u2019s response<\/p>\n