Scattered Lapsus$ Hunters Returns With Salesforce Leak Site

Scattered Lapsus$ Hunters — an apparent collaboration of Scattered Spider, Lapsus$, and ShinyHunters — resurfaced with a Dark Web leak site claiming roughly 1 billion stolen Salesforce records and listing 39 alleged victims while threatening to publish full data unless paid; Salesforce states no evidence the platform itself was compromised. The report highlights two related campaigns: UNC6040 (vishing to obtain Salesforce access) and UNC6395 (use of stolen Salesloft Drift OAuth tokens), notes potential PII exposure and third‑party token abuse, and documents active extortion activity and deadlines.