Salesforce refuses to pay ransom over widespread data theft attacks

Salesforce customers were impacted by two 2025 campaigns that stole large volumes of CRM and support-ticket data via social engineering (malicious OAuth apps) and stolen SalesLoft/Drift OAuth tokens; threat actors including ShinyHunters and a group calling themselves Scattered Lapsus$ Hunters claimed up to ~1–1.5 billion records across hundreds of companies and launched an extortion/data-leak site to pressure victims and Salesforce for payment.