\n<\/p>\n
A notorious predominantly English-speaking hacking group has launched a website to extort its victims, threatening to release about a billion records stolen from companies who store their customers\u2019 data in cloud databases hosted by Salesforce.<\/p>\n
The loosely organized group, which has been known as Lapsus$<\/a>, Scattered Spider<\/a> and ShinyHunters<\/a>, have published a dedicated data leak site on the dark web, called Scattered LAPSUS$ Hunters.\u00a0<\/p>\n The website, first spotted by threat intelligence researchers on Friday and seen by TechCrunch, aims to pressure victims<\/a> into paying the hackers to avoid having their stolen data published online.\u00a0<\/p>\n \u201cContact us to regain control on data governance and prevent public disclosure of your data,\u201d reads the site. \u201cDo not be the next headline. All communications demand strict verification and will be handled with discretion.\u201d<\/p>\n Over the last few weeks, the ShinyHunters gang allegedly hacked dozens of high-profile companies by breaking into their cloud-based databases hosted by Salesforce<\/a>.\u00a0<\/p>\n Insurance giant Allianz Life<\/a>, Google<\/a>, fashion conglomerate Kering<\/a>, the airline Qantas<\/a>, carmaking giant Stellantis<\/a>, credit bureau TransUnion<\/a>, and the employee management platform Workday<\/a>, among several others, have confirmed their data was stolen in these mass hacks.<\/p>\n The hackers\u2019 leak site lists several alleged victims, including FedEx, Hulu (owned by Disney), and Toyota Motors, none of which responded to a request for comment on Friday.<\/p>\n It\u2019s not clear if the companies known to have been hacked but not listed on the hacking group\u2019s leak site have paid a ransom to the hackers to prevent their data from being published. A representative from ShinyHunters did not immediately respond to a message from TechCrunch.<\/p>\n At the top of the site, the hackers mention Salesforce and demand that the company negotiate a ransom, threatening that otherwise \u201call your customers [sic] data will be leaked.\u201d The tone of the message suggests that Salesforce has not yet engaged with the hackers.<\/p>\n A spokesperson for Salesforce did not respond to TechCrunch\u2019s outreach or questions about the breach.<\/p>\n For weeks, security researchers have speculated that the group, which has historically eschewed a public presence online, was planning to publish a data leak website<\/a> to extort its victims.\u00a0<\/p>\n Historically, such websites have been associated with foreign, often Russian-speaking, ransomware gangs. In the last few years, these organized cybercrime groups have evolved from stealing, encrypting their victim\u2019s data and then privately asking for a ransom, to simply threatening to publish the stolen data online unless they get paid.\u00a0<\/p>\n<\/div>\n