Scattered Lapsus$ Hunters says it has stolen more than 1 billion Salesforce records. That figure is the group’s own claim, made across two extortion campaigns, and nothing in the record shows it has been independently checked.
The crew calls itself the “Trinity of Chaos.” It says it grew out of three older outfits: Muddled Libra, better known as Scattered Spider, Bling Libra, or ShinyHunters, and LAPSUS$. All sit inside a wider network called “The Com.” Bling Libra has steered that network since 2020 away from selling stolen data and toward extorting victims directly. Its favorite marks are retail and hospitality companies whose customer details live in Salesforce tenants.
The leak site and the deadline
On October 3, 2025, the group put up a data leak site on a BreachForums domain. It named 39 organizations worldwide and gave them until October 10 to pay.
The model is extortion as a service. The group recruits through Telegram, looking for executive email access, and keeps a 25 to 30 percent cut. Salesforce was on the target list too. It refused to pay.
The FBI seized the BreachForums domains on October 9, one day before the deadline. The group answered with threats to dump the data anyway.
Red Hat and the wider damage
A collaborator, Crimson Collective, breached Red Hat on October 1. It took 570 GB from 28,000 repositories, customer reports among them.
Victims face identity theft and fraud. In retail that can mean gift cards; in hospitality, loyalty points. Trust takes a hit as well. Extortion as a service also helps the crews slip past crackdowns aimed at ransomware.
The recommended defenses are plain: credential scanning, zero trust, conditional access, and intelligence from ISACs, the industry information-sharing groups.
Sources
Sources
- Claims of a 1-Billion Record Salesforce Data Theft Surface Amid…
- Scattered Lapsus$ Hunters Claim 1 Billion Salesforce Records…
