ShinyHunters behind Salesforce data theft attacks at Qantas, Allianz Life, and LVMH

**Summary:** Multiple data breaches and ongoing extortion attempts have been linked to ShinyHunters/UNC6040 (with extortion activity attributed to UNC6240) using vishing and OAuth-connected-app social engineering to install a malicious Data Loader app in Salesforce instances, impacting organizations including Qantas, Allianz Life, LVMH, and Adidas; Salesforce states the platform was not compromised and recommends MFA, least-privilege, restricting connected apps, and monitoring as mitigations.