Archive · 29 Oct 2025
Hackers Claim Massive Salesforce Breach; Major Brands Allegedly Affected
Imagine a giant digital filing cabinet called Salesforce that many big companies use to keep customer information safe.
Some hackers are saying they found a way to sneak into this cabinet and copied almost a billion files.
These files supposedly have people's names, phone numbers, and birthdays.
They claim the information belongs to customers of famous companies like Disney and Toyota.
Salesforce hasn't said if this is true yet, but security experts are worried.
The hackers might be the same group that recently attacked other big companies.
They get this information to trick people into giving up more details, which can lead to stolen money or identities.
To stay safe, it's important to use strong, different passwords for all your accounts, turn on extra security steps like two-factor authentication, and watch your bank accounts for anything unusual.
Even though companies try to protect data, sometimes mistakes or trickery can let hackers in.
Hackers claim to have stolen nearly one billion customer records from the cloud technology giant Salesforce.
Allegedly stolen data includes names, email addresses, phone numbers, dates of birth, and loyalty program information.
The hackers claim customer data from well-known companies such as Disney, Toyota, and Google were accessed.
The group is believed to be an offshoot of the LAPSUS$ cybercrime network, known for social engineering tactics.
Experts advise users to change passwords, enable two-factor authentication, and monitor accounts for suspicious activity.
- Who
- Hackers allegedly linked to the LAPSUS$ group (reportedly UNC6040)
- What
- Claim to have breached Salesforce and stolen nearly one billion records of personal customer data from numerous major companies
- When
- Recent wave of ransomware attacks
- Where
- Global, targeting companies using Salesforce cloud technology
- Why
- To obtain personal data for financial gain through phishing scams and identity theft, or to embarrass companies.
Hackers' Claims
Current Status/Company Stance
Breach Confirmation
Hackers' Claims
Hackers claim they have successfully accessed and stolen approximately one billion customer records from Salesforce.
Current Status/Company Stance
Salesforce has not yet confirmed or denied the breach, and the full extent of any compromise is unverified.
Scope of Impact
Hackers' Claims
The alleged data theft impacts customers of numerous major global brands, including Disney, Toyota, and Google.
Current Status/Company Stance
While user data from multiple companies is allegedly compromised, the exact number and identity of affected companies and individuals remain unconfirmed by official sources.
Attribution
Hackers' Claims
The perpetrators are identified as a group linked to the LAPSUS$ network, specializing in social engineering.
Current Status/Company Stance
Security experts are tracking this splinter group, reportedly designated UNC6040 by Google's Threat Intelligence team, but official confirmation of their direct involvement in this specific alleged breach is pending.
- Alleged Perpetrator Group
- Offshoot of LAPSUS$ cybercrime network (reportedly UNC6040)
- Alleged Data Stolen
- Names, email addresses, phone numbers, dates of birth, loyalty program info
- Alleged Companies Affected
- Adidas, Cisco, Disney, Google, IKEA, Pandora, Toyota, and others
- Cybersecurity Council Warning
- Over 1.4 billion accounts hacked globally each month
- Primary Motivation for Attacks
- Financially motivated (estimated 97% of cyberattacks)
- Median Time to Detect Breach
- Five days