Salesforce Breach Hackers Publish Leak Site: 39 Victims

On October 3, 2025, another big cybersecurity story broke. This time, it’s Salesforce customers under fire. A hacker group called ShinyHunters has launched a leak site and claims to have stolen data from 39 different companies. Their aim? Extortion: pay up or see your data published online. The site was published under the name Scattered LAPSUS$ Hunters, a collective that includes ShinyHunters.

The important part: Salesforce itself wasn’t hacked. Instead, attackers went after customer accounts and integrations, mainly by tricking people and abusing connected apps.

Who Are ShinyHunters?

ShinyHunters is a well-known hacking group that’s been around since 2020, responsible for several major data leaks. They usually show up on dark web forums with massive stolen databases.

In this campaign, they used social engineering similar to that of Scattered Spider (tracked by Google as UNC3944), focusing on people and third-party connections instead of breaking into Salesforce’s core systems. Google tracks the Salesforce vishing intrusions as UNC6040, and the extortion activity that follows them, which uses the ShinyHunters name, as UNC6240.

How Did the Attack Happen

Hackers didn’t exploit a Salesforce bug. Instead, they used a mix of social engineering and tool abuse:

Phone Scams (Vishing)

Attackers called employees, pretended to be tech support, and convinced them to give access.

Fake Connected Apps

They got companies to approve malicious apps through OAuth, which handed them valid tokens.

Data Loader Abuse

They reportedly used modified versions of Salesforce’s Data Loader to pull huge amounts of data quickly.

Companies Impacted

The ShinyHunters leak site lists 39 companies. Some of the most notable include:

• Google – listed on the site as “Google AdSense”; in August 2025, Google disclosed that a corporate Salesforce instance holding largely public contact details of small and medium businesses was accessed.
• Chanel – disclosed that a database hosted by a third-party provider, containing contact details of some U.S. clients who had contacted client care, was accessed.
• Other names on the site include Adidas, Cisco, Qantas, Disney/Hulu, IKEA, McDonald’s, Toyota, FedEx, UPS, and Air France-KLM.

Important: being listed doesn’t always mean a full-scale breach—the group’s claims have not all been independently verified.

Salesforce and Law Enforcement Response

Salesforce confirmed its systems remain secure despite ShinyHunters’ extortion campaign

Salesforce has stated its main systems remain secure. The attacks targeted customer environments and integrations. In a September 12, 2025 FLASH advisory, the FBI warned of active campaigns by groups like UNC6040 (vishing) and UNC6395 (stolen Salesloft Drift OAuth tokens) against Salesforce customers. Google Threat Intelligence described it as a data extortion operation and urged organizations to check their connected apps.

What happened next: Salesforce said it would “not engage, negotiate with, or pay any extortion demand.” Around October 10, 2025, US authorities, with French police, seized a BreachForums domain the group had been using, while its dark-web leak site stayed online. The group then published data it attributed to six listed companies: Qantas, Vietnam Airlines, Gap, Fujifilm, Albertsons, and Engie Resources.

Potential Impact of the Breach

Loss of Customer Trust

If private data is exposed, customers may lose confidence.

Regulatory Penalties

Companies could face fines under strict data protection laws.

Financial Costs

Handling incident response, legal issues, and remediation can be expensive.

Reputational Damage

Negative press and brand image damage may hurt future business.

How to Protect Your Company

Four of the five key steps businesses can take after the ShinyHunters Salesforce breach; the fifth, restricting Data Loader and admin access, is described below

1. Audit OAuth Apps

Review all connected apps and revoke suspicious or unnecessary permissions.

2. Enable Multi-Factor Authentication (MFA)

Require MFA for all users, especially those with admin rights.

3. Train Employees

Educate staff to spot phishing or vishing attempts before granting access.

4. Monitor Logs

Keep an eye on Salesforce activity logs for unusual behavior.

5. Restrict Access

Limit who can use tools like Data Loader and reduce the number of admins.

Conclusion

The attackers targeted Salesforce customers’ users and connected apps, not the platform itself.

If your company uses Salesforce, don’t wait for a scare like this. Audit your apps, enforce strong login security, and train your employees to spot scams.

Bottom line: Salesforce wasn’t hacked, but attackers took advantage of poor security practices. Now’s the time to lock things down.

FAQs

Was Salesforce hacked?
No. Salesforce’s core systems remain secure. The attacks targeted customer accounts, integrations, and employees.

Which companies were affected by the ShinyHunters breach?
The leak site listed 39 companies, including Google, Chanel, Adidas, Cisco, Toyota, Disney, Ikea, and McDonald’s.

How did hackers steal Salesforce data?
They tricked employees with phone scams, abused OAuth permissions, and used modified Data Loader tools to extract large datasets.

What should companies do right now?
Review OAuth apps, enable MFA, train employees, and monitor system logs for unusual activity.

Could my company be at risk?
If you use Salesforce and haven’t reviewed your connected apps or security settings recently, then yes—you could be vulnerable.