Data Is the New Diamond: Heists in the Digital Age

Unit 42 reports an ongoing data theft extortion campaign since Dec 2024 that targets high-end retail (and other sectors) by using voice phishing (vishing) to gain access to cloud platforms—notably Salesforce—then conducting internal reconnaissance and exfiltrating customer PII (names, DOB, addresses, phone numbers, account metadata). The activity is attributed to UNC6040 for initial access/exfiltration and Bling Libra (ShinyHunters) for extortion; actors use minimal malware, rely on social engineering and reconnaissance, and may move to dedicated leak sites.