THE MEGA BREACH: One Billion Records Stolen from Toyota, Disney, McDonald’s, and HBO Max in Massive Salesforce Supply Chain Attack

Author: CyberDudeBivash — cyberbivash.blogspot.com | Published: Oct 12, 2025

TL;DR

A criminal consortium calling itself **Scattered LAPSUS$ Hunters** claims to have exfiltrated **~1 billion records** from the Salesforce-hosted stores of roughly 39 customers, listing major names including Toyota, Disney, McDonald’s and HBO Max.
Salesforce says there is no evidence its platform itself was compromised and has refused to negotiate with extortionists — investigations with law enforcement and forensic partners are ongoing.
Reportedly impacted companies and responders should assume sensitive configuration and customer-engagement artifacts may be exposed, prioritize secrets rotation, and launch high-signal hunts for misuse.

What the claim says

On Oct 3, 2025 a dark-web extortion site run by the group calling itself *Scattered LAPSUS$ Hunters* publicly posted claims that it had copied nearly one billion records from the Salesforce-related repositories of roughly 39 organizations, and threatened to publish data unless paid. The group named numerous household brands in its claims (Toyota, Disney, McDonald’s, HBO Max among them). Independent reporting on the claim appears across mainstream outlets.

What Salesforce says (and why it matters)

Salesforce has stated it will not negotiate or pay extortion demands and says its own platform has not been found to be vulnerable or breached; the company is investigating the matter with external forensic teams and law enforcement. Organizations that use Salesforce should treat the vendor statement seriously but still validate whether customer-specific artifacts or integrations were impacted.

Why this type of incident is especially painful

Rich, cross-customer reconnaissance:
Scale & reuse risk:
Supply-chain cascade:

Immediate priority checklist for impacted orgs & customers

Triage these now — assume data mentioning your organization could be in the wild.

Ask the vendor for specifics:
Rotate secrets & keys immediately:
Harden authentication:
Increase telemetry & hunts:
Isolate & preserve evidence:
Communicate to stakeholders:

High-signal hunting recipes

Tune these templates to your SIEM and environment. They are defensive detection ideas, not offensive instructions.

# Example (Splunk-style): anomalous CI/CD release pushes
index=ci source=gitlab OR source=github_actions event=push
| stats count by user, repo, branch, _time
| where branch IN ("main","release") AND count > 5 AND _time > relative_time(now(), "-7d")

# Example (pseudo-SQL): unexpected API key use
SELECT api_key, COUNT(*) AS uses, MAX(request_time) as last_use
FROM api_audit
WHERE request_time > NOW() - INTERVAL '14' DAY
GROUP BY api_key
HAVING uses > normal_threshold;

# Network egress (quick): hosts with large outbound uploads after a new token appears
SELECT src_host, SUM(bytes_sent) AS outbound_bytes
FROM netflow
WHERE event_time > NOW() - INTERVAL '24' HOUR
GROUP BY src_host
HAVING outbound_bytes > 100000000;  -- tune to your baseline

Incident response: prioritized steps

Contain & preserve:
Rotate & remediate:
Hunt & pivot:
Rebuild trusted paths:
Coordinate with vendors & law enforcement:

Longer-term lessons & supplier governance

Secrets should never live in repos:
Require SBOMs & provenance:
Contractual SLAs for security:
Test supplier compromise scenarios:

What consumers & customers should do

Be alert to phishing and credential-recovery scams impersonating the named brands; validate messages via official vendor sites and do not click links in unsolicited emails.
Use unique passwords and enable MFA on accounts tied to affected services; consider password manager use if you are not already using one.
If you receive a vendor notice that you are impacted, follow their guidance and keep copies of any official communications for your records.

Sources & further reading

Reuters — “Almost 1 billion Salesforce records stolen, hacker group claims” (Oct 3, 2025).
TechCrunch — coverage of the extortion site and named victims.
The Guardian — reporting on the scope and the group’s claims against nearly 40 companies.
Ars Technica — Salesforce statement and refusal to negotiate with extortionists.
Cybersecurity Dive — Salesforce response and investigation outline.
Help Net Security / industry writeups summarizing the leak-site and defensive guidance.

Explore the CyberDudeBivash Ecosystem

Need help handling a supplier-data exposure or a Salesforce-related incident?

Supply-chain incident playbooks & rapid triage
Secrets rotation runbooks, CI/CD audits & SBOM integration
SIEM/EDR hunt packs and prioritized detection engineering

Hashtags:

#CyberDudeBivash #SalesforceBreach #SupplyChainSecurity #DataBreach #IncidentResponse #SecretsHygiene

Cyberdudebivash