Share with your friends!

salesforce says it won t pay extortion Salesforce has announced its decision to refuse payment to a crime syndicate that claims to have stolen approximately 1 billion records from various Salesforce customers.

salesforce says it won t pay extortion

Background of the Incident

The extortion threat emerged in May 2025, when a group of attackers began targeting organizations that utilize Salesforce’s platform. According to Google-owned cybersecurity firm Mandiant, the attackers initiated their campaign by making voice calls to potential victims, attempting to manipulate them into connecting an attacker-controlled application to their Salesforce accounts. This tactic, which involves social engineering, has proven effective, as many individuals complied with the requests.

Salesforce, a leading customer relationship management (CRM) platform, serves a vast array of businesses across different sectors. The scale of the alleged breach is alarming, as it involves a staggering number of records, which could potentially contain sensitive customer information, proprietary business data, and other confidential materials. The implications of such a breach extend beyond the immediate financial concerns of extortion, affecting customer trust and the overall reputation of the Salesforce platform.

The Extortion Group: Scattered LAPSUS$ Hunters

The group behind this extortion attempt has branded itself as the “Scattered LAPSUS$ Hunters.” This name is a combination of three notorious data-extortion groups: Scattered Spider, LAPSuS$, and ShinyHunters. Each of these groups has made headlines in recent years for their sophisticated cyberattacks and data breaches. Mandiant refers to this new group as UNC6040, as they have yet to establish definitive links between the various actors involved.

Profile of the Threat Actors

Understanding the profile of the Scattered LAPSUS$ Hunters provides insight into the evolving landscape of cybercrime. The group appears to have adopted tactics from its predecessors, utilizing social engineering and phishing techniques to gain access to sensitive systems. Their method of operation includes:

Voice Phishing: The attackers use voice calls to impersonate legitimate entities, creating a sense of urgency that pressures targets into compliance.
Application Manipulation: By convincing victims to connect to malicious applications, the attackers can gain unauthorized access to Salesforce accounts.
Data Theft: The group claims to have stolen a vast amount of data, which they are now using as leverage for extortion.

The emergence of such groups highlights the increasing sophistication of cybercriminals and the need for organizations to bolster their cybersecurity measures.

Salesforce’s Response

In light of the extortion demand, Salesforce has taken a firm stance against paying the ransom. The company has publicly stated that it will not comply with the demands of the Scattered LAPSUS$ Hunters. This decision aligns with the broader cybersecurity principle of not negotiating with cybercriminals, as paying ransoms can encourage further attacks and does not guarantee the safe return of stolen data.

Implications of the Decision

Salesforce’s refusal to pay the extortion demand carries significant implications:

Customer Trust: By taking a strong stance against extortion, Salesforce aims to reassure its customers that it prioritizes their security and will not capitulate to criminal demands.
Industry Standards: The decision may set a precedent for other companies facing similar threats, encouraging them to adopt a similar approach in dealing with extortion attempts.
Legal and Regulatory Considerations: Organizations must navigate the complex legal landscape surrounding data breaches and extortion, which can vary by jurisdiction.

Potential Consequences for Affected Customers

While Salesforce has chosen not to pay the ransom, the ramifications of the breach are still significant for its customers. The potential exposure of sensitive data raises concerns about identity theft, fraud, and other malicious activities. Customers whose data may have been compromised could face various challenges, including:

Increased Risk of Fraud: Stolen data can be used for identity theft, leading to financial losses for individuals and businesses.
Reputational Damage: Companies that experience data breaches may suffer reputational harm, impacting customer loyalty and trust.
Legal Repercussions: Organizations may face lawsuits or regulatory penalties if they fail to adequately protect customer data.

The Role of Cybersecurity in Modern Business

The incident involving Salesforce underscores the critical importance of cybersecurity in today’s digital landscape. As businesses increasingly rely on cloud-based services and digital platforms, the need for robust security measures becomes paramount. Organizations must adopt a proactive approach to cybersecurity, which includes:

Employee Training: Regular training sessions can help employees recognize phishing attempts and social engineering tactics.
Multi-Factor Authentication: Implementing multi-factor authentication can add an extra layer of security to sensitive accounts.
Regular Security Audits: Conducting regular audits can help identify vulnerabilities and ensure compliance with industry standards.

Stakeholder Reactions

The response to Salesforce’s decision not to pay the ransom has elicited varied reactions from stakeholders, including cybersecurity experts, business leaders, and customers. Many experts commend Salesforce for its refusal to negotiate with cybercriminals, viewing it as a responsible approach that prioritizes long-term security over short-term solutions.

Conversely, some stakeholders express concern about the potential fallout from the breach. Customers may feel anxious about the security of their data and the implications of the breach on their own operations. Business leaders are also closely monitoring the situation, as it may influence their own cybersecurity strategies and risk management practices.

Conclusion

The extortion attempt against Salesforce serves as a stark reminder of the evolving threats in the cybersecurity landscape. As cybercriminals become increasingly sophisticated, organizations must remain vigilant and proactive in their security measures. Salesforce’s decision to refuse payment to the Scattered LAPSUS$ Hunters reflects a commitment to maintaining customer trust and upholding industry standards. However, the potential consequences of the breach for affected customers cannot be overlooked, highlighting the need for ongoing vigilance in the face of cyber threats.

Source: Original report