Millions of records leaked after data theft from Salesforce customers
Attackers stole data from dozens of Salesforce customers and used it to demand money. The attackers claimed to have obtained more than about 1 billion records, and Salesforce refused to pay. Even after the FBI's takedown, the attack group released millions of records.
Key facts
- Affected organisation
- Salesforce
- Incident type
- Data breach
- Occurred / detected
- Not confirmed
- Scale of damage
- Data stolen from dozens of customers and millions of records released
- Cause / method
- Hacking targeting customers and extortion based on stolen data
- Location
- Other countries
If your data was exposed
- Don’t tap links in texts, calls or emails that mention this incident and offer compensation, refunds or breach checks. Check directly on the organisation’s official website or app.
Timeline
- The attack group claimed to have stolen about 1 billion Salesforce-related records and launched a customer data leak site.
- Extortion targeting Salesforce using data stolen from dozens of customers became known.
- Salesforce said it would not pay the attackers.
- The attackers said they would keep releasing data even after BreachForums was seized.
- The attack group released millions of records after the FBI's takedown.
11 related reports
- Almost 1 billion Salesforce records stolen, hacker group claims
- Ransomware Group Debuts Salesforce Customer Data Leak Site
- Hackers Extorting Salesforce After Stealing Data From Dozens of Customers
- Salesforce refuses to pay ransom over widespread data theft attacks
- Salesforce Tells Clients It Won’t Pay Hackers for Data Extortion
- Hackers Claim Salesforce Data Breach Leaks Over 1 Billion Records
- Salesforce refuses to submit to extortion demands linked to hacking campaigns
- Salesforce turns down ransomware payment demands
- BreachForums seized, but hackers say they will still leak Salesforce data
- Extortion Group Leaks Millions of Records From Salesforce Hacks
- Salesforce Extortion Group Leaks Data After FBI Disruption
Other incidents at Salesforce
Breach of Gainsight-connected apps leads to unauthorised access to Salesforce customer data
Impact: Unauthorised access to some customer data; actual extent of damage under investigation
Unauthorised access to some Salesforce customer data occurred through a breach of Gainsight-connected apps. The related tokens were revoked, distribution of the apps was suspended, and Salesforce investigated the damage. ShinyHunters claimed to have accessed 285 Salesforce environments, but the actual extent of the damage has not been confirmed.
Related reports: 7 · last report →Domains used in Salesforce breach attacks taken down
A series of breach attacks targeting Salesforce took place. The FBI shared related indicators of compromise, and domains used by ShinyHunters to hack Salesforce were later taken down.
Related reports: 3 · last report →Data theft attacks targeting Salesforce customers spread
↳ Knock-on damage from the Salesloft incident · View original incident1.5bnImpact: Hundreds of customers affected; attackers claim theft of 1.5 billion records
Data theft attacks targeting Salesforce customers continued, with several companies including Google confirming they were affected. The attacks involved voice phishing and the abuse of stolen OAuth tokens from Salesloft Drift. Drift was taken offline, and ShinyHunters claimed to have stolen 1.5 billion records through the Drift hack.
Related reports: 15 · last report →
The summary and key facts are written by AI from related reports and may contain errors. Check the original articles and the organisation’s official statements for accurate details.