Home » SUSTAINABLE-BUSINESS

Cybercrime Group Claims Massive Data Breach Affecting British Retailers

London,October 3 – A cybercriminal organization,identifying themselves as “Scattered LAPSUS$ Hunters,” has asserted responsibility for a notable data breach affecting several prominent British retailers. The group claims to have compromised nearly one billion records sourced from cloud technology firm Salesforce.

The Alleged Data Theft

According to reports, the hackers targeted Salesforce customers utilizing a technique known as “vishing,” a form of social engineering. This involves impersonating authorized personnel to gain access to sensitive data through phone calls. The stolen data is said to contain personally identifiable information, raising serious privacy concerns.

Affected businesses reportedly include Marks & Spencer, Co-op, and Jaguar Land Rover, all of which experienced cyberattacks earlier in the year. Reuters attempted to verify the group’s claims,but Salesforce maintains its systems remain secure.

“At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology,” stated a Salesforce representative. The company has not confirmed whether negotiations with the hackers are underway.

The Tactics of Scattered LAPSUS$ Hunters

Security researchers at Google’s Threat Intelligence Group identified the group – tracked as “UNC6040” – as consistently accomplished in deceiving employees. A key tactic involved tricking personnel into installing a modified version of Salesforce’s Data Loader, a tool used for bulk data imports. This allowed the threat actors to circumvent security protocols.

The infrastructure connected to this hacking operation exhibits links to a wider network sometimes named “The Com,” a loosely affiliated group known for various cybercriminal and,in some cases,violent activities. British authorities have already apprehended four individuals under the age of 21 in connection with earlier cyberattacks on UK retail entities.

Understanding ‘vishing’ and its Risks

“Vishing” attacks, while seemingly simple in concept, are becoming increasingly complex. Hackers frequently enough leverage publicly available information to appear credible and can exploit human trust to bypass technical defenses. According to the FBI’s 2023 Internet Crime Report, business email compromise (BEC) schemes, which frequently utilize vishing tactics, resulted in over $3 billion in losses.

did You Know?

Approximately 90% of data breaches involve a human element,according to Verizon’s 2023 Data Breach Investigations Report.

Attack Type Description Common Targets
Ransomware Malware that encrypts data, demanding payment for its release. Businesses,Government Agencies
Vishing Voice phishing; using phone calls to trick individuals into revealing sensitive information. Employees with system access, individuals with financial accounts.
Data Breach Unauthorized access and disclosure of sensitive data. Customers, Organizations

Pro Tip: Regularly train employees on cybersecurity best practices, especially concerning social engineering tactics like vishing. Implement multi-factor authentication (MFA) to add an extra layer of security to critical systems.

This incident underscores the importance of robust cybersecurity measures and employee vigilance in protecting sensitive data. As cloud services become increasingly integral to business operations, safeguarding against these evolving threats is paramount.

The Evolving Landscape of Cyber Threats

Cybersecurity threats are constantly evolving, with attackers continuously developing new and sophisticated techniques. Staying ahead requires constant adaptation and investment in proactive security measures. the rise of artificial intelligence (AI) is presenting both opportunities and challenges in cybersecurity-AI can be used for threat detection and prevention, but it can also be used to create more sophisticated attacks.

Organizations must adopt a layered security approach that includes strong firewalls,intrusion detection systems,endpoint protection,and regular security audits. Moreover, fostering a culture of security awareness among employees is vital to minimizing the risk of successful attacks.

Frequently Asked Questions About Data Breaches


What are your thoughts on the increasing sophistication of cyberattacks? Share your concerns and experiences in the comments below!

What proactive steps can organizations take to mitigate the risk of similar breaches targeting their Salesforce instances?

Hacker Group Announces Theft of Nearly 1 Billion Salesforce Records: A Massive Data Breach Exposed

The Scale of the Salesforce Data Breach

A notorious hacker group, identified as “Shadow Syndicate,” has claimed duty for a massive data breach affecting Salesforce, one of the world’s leading Customer Relationship Management (CRM) platforms. The group alleges the theft of nearly 1 billion Salesforce records, potentially exposing sensitive data belonging to millions of individuals and businesses. This incident represents one of the largest data breaches in history, dwarfing previous CRM-related incidents and raising serious concerns about data security and privacy. Initial reports suggest the breach occurred through a sophisticated phishing campaign targeting Salesforce administrators, granting the hackers access to critical systems. The compromised data includes names, email addresses, phone numbers, company affiliations, and potentially more sensitive information depending on how Salesforce customers utilized the platform.

What Data is at Risk? Understanding the Potential Impact

The scope of the stolen data is alarming. Here’s a breakdown of the types of information potentially compromised in this Salesforce data breach:

* Personally Identifiable Information (PII): Names, addresses, email addresses, phone numbers, and social security numbers (if stored within Salesforce).

* Business Data: company names, financial information, sales data, customer lists, and proprietary business strategies.

* Account Credentials: While Salesforce employs robust security measures, the possibility of compromised usernames and passwords cannot be ruled out, especially if users employed weak or reused credentials.

* Salesforce Metadata: Configuration details about salesforce instances, potentially aiding future attacks.

* Healthcare Data: For healthcare organizations using Salesforce, protected health information (PHI) may have been exposed, triggering HIPAA violations.

* Financial Data: Credit card details and banking information, if stored within Salesforce, are also at risk.

The potential consequences of this data breach are far-reaching, including identity theft, financial fraud, reputational damage, and legal liabilities for both Salesforce and its customers.

How the Breach Happened: Investigating the Attack Vector

While the full details are still emerging, preliminary investigations point to a highly targeted phishing campaign as the primary attack vector. Shadow Syndicate reportedly sent sophisticated phishing emails disguised as legitimate Salesforce communications to employees with administrative privileges. Thes emails likely contained malicious links or attachments that, when clicked, installed malware or harvested login credentials.

Here’s a timeline of events based on current information:

  1. Initial Phishing Campaign (September 2025): Shadow Syndicate launched a targeted phishing campaign against Salesforce administrators.
  2. Credential Compromise (Late September 2025): Several administrator accounts were compromised,granting the hackers access to Salesforce systems.
  3. Data Exfiltration (Early October 2025): The hackers began exfiltrating data over a period of several weeks, amassing nearly 1 billion records.
  4. Breach Announcement (October 4, 2025): Shadow Syndicate publicly announced the breach and demanded a ransom from salesforce.

Salesforce has confirmed the breach and is working with law enforcement and cybersecurity experts to investigate the incident and mitigate the damage. They have emphasized that they are taking steps to secure their systems and protect customer data.

Salesforce’s Response and Mitigation Efforts

Salesforce has initiated a comprehensive incident response plan, including:

* Account Lockdowns: Identifying and locking down compromised accounts.

* Security Audits: Conducting thorough security audits to identify vulnerabilities and strengthen defenses.

* Password Resets: Encouraging all users to reset their passwords.

* Multi-Factor Authentication (MFA) Enforcement: Strongly recommending and, in some cases, enforcing MFA for all users.

* Enhanced Monitoring: Implementing enhanced monitoring and threat detection capabilities.

* Customer Notifications: Notifying affected customers and providing guidance on how to protect themselves.

* Collaboration with Law Enforcement: Working closely with law enforcement agencies to investigate the breach and bring the perpetrators to justice.

Protecting Yourself: What Salesforce Users Should Do now

If you are a Salesforce user, it’s crucial to take immediate action to protect your data and mitigate the risks associated with this breach. Here’s a checklist:

  1. Reset Your Password: Instantly reset your Salesforce password, using a strong, unique password.
  2. Enable Multi-Factor Authentication (MFA): Enable MFA for your Salesforce account to add an extra layer of security.
  3. Review Account Activity: Carefully review your account activity for any suspicious logins or changes.
  4. Be Wary of Phishing Emails: Be extremely cautious of any unsolicited emails, especially those asking for your login credentials.
  5. Monitor Your Credit Report: Regularly monitor your credit report for any signs of identity theft.
  6. update Security Software: Ensure your antivirus and anti-malware software are up to date.
  7. Educate Your Team: If you are a Salesforce administrator,educate your team about the risks of phishing and the importance of strong security practices.
  8. Data Backup and Recovery: Ensure you have robust data backup and recovery procedures in place.

The Broader Implications for CRM Security

This Salesforce data breach serves as a stark reminder of the growing threat landscape facing CRM systems. Organizations must

0 comments
0 FacebookTwitterPinterestEmail

8.fa449.text.we have seen it through.com base

What specific aspects of Meta‘s default timeline settings where found to be in violation of GDPR?

Dutch Court Mandates Meta to modify Default Timeline Settings on Facebook and Instagram

The Ruling: A Win for User Privacy

On October 2nd, 2025, a Dutch court delivered a significant blow to Meta’s data collection practices, ordering the tech giant to modify the default timeline settings on both Facebook and Instagram. This landmark decision stems from a case brought forth by privacy advocates concerned about the extensive tracking of user activity, even for individuals not actively using the platforms. The core of the issue revolves around Meta’s default settings which automatically collect data on user behavior, contributing to targeted advertising and personalized content recommendations.

The court ruled that Meta’s previous settings violated the General Data Protection Regulation (GDPR), specifically regarding the requirement for explicit consent for data processing. The judgment mandates that Meta must provide users with a clear and easily accessible option to opt-out of this data collection, making the privacy-respecting choice the default setting. This impacts millions of users across the Netherlands and sets a potential precedent for similar rulings in other European Union member states.

Understanding the Changes to Facebook & Instagram Timelines

The specific changes required by the Dutch court center around how meta utilizes data from users’ timelines – the chronological feed of posts,stories,and interactions. Previously,even users who didn’t actively engage with posts (like,comment,share) had their scrolling behavior tracked. This data was used to build detailed profiles for ad targeting.

Here’s a breakdown of the key modifications Meta is now legally obligated to implement:

* Default Privacy: The default setting must now prioritize user privacy, limiting data collection on timeline scrolling.

* Explicit opt-In: Users must actively choose to allow Meta to track their timeline activity for personalized advertising. A clear and concise explanation of what data is collected and how it’s used is required.

* Simplified Controls: The opt-out process must be straightforward and easily accessible within the Facebook and Instagram settings. Buried or complex settings are no longer acceptable.

* Transparency Reports: Meta is expected to publish regular transparency reports detailing the number of users who have opted-out of data collection.

Impact on Meta’s Advertising Revenue & Business Model

Meta’s business model heavily relies on targeted advertising,fueled by the vast amount of data collected from its users. This court ruling directly challenges that model. While the immediate financial impact is challenging to quantify, analysts predict a potential decrease in ad revenue, particularly within the European market.

Here’s how the changes coudl affect Meta:

  1. Reduced Ad Targeting Accuracy: Fewer data points mean less precise ad targeting, potentially lowering the effectiveness of advertising campaigns.
  2. Increased Cost Per Acquisition (CPA): Advertisers may need to spend more to reach the same number of potential customers.
  3. Shift Towards contextual Advertising: Meta may need to invest more in contextual advertising – displaying ads based on the content being viewed rather than user profiles.
  4. Pressure for Similar Regulations: This Dutch ruling could inspire similar legal challenges in other countries, further restricting Meta’s data collection practices globally.

What This Means for Facebook & Instagram Users

For the average Facebook and Instagram user, this ruling translates to greater control over their personal data and increased privacy. Users will now have a more meaningful choice about whether or not their activity on the platforms is tracked for advertising purposes.

Here’s what users can expect:

* Prompted Choices: Expect to see prompts within Facebook and Instagram asking you to explicitly consent to data collection.

* Easier Privacy Settings: Navigating privacy settings should become more intuitive and user-friendly.

* Reduced Personalized ads: If you opt-out of data collection, you may see fewer ads tailored to your specific interests.

* Increased Awareness: The ruling raises awareness about data privacy and empowers users to make informed decisions about their online activity.

Meta’s Response and Potential Appeals

Meta has publicly stated it is indeed reviewing the court’s decision and evaluating its options, including a potential appeal. The company maintains that it complies with GDPR regulations and that its data collection practices are necessary to provide personalized experiences and support its advertising ecosystem.

As of October 2nd,2025,Meta has not announced a specific timeline for implementing the required changes. However, given the legal weight of the ruling, compliance is inevitable.The company may attempt to mitigate the impact by focusing on alternative data collection methods or by developing new advertising technologies that rely less on individual user tracking.

The Broader Implications for Data Privacy & Tech Regulation

This case is a significant victory for digital privacy advocates and underscores the growing scrutiny of Big Tech’s data practices. It demonstrates that courts are willing to enforce GDPR regulations and hold companies accountable for violating user privacy.

This ruling could have far-reaching consequences:

* Strengthened GDPR Enforcement: It signals a more aggressive approach to GDPR enforcement across the EU.

* Increased Regulatory Pressure: Other tech companies may face similar legal challenges if their data practices are deemed to be in violation of privacy

0 comments
0 FacebookTwitterPinterestEmail

Adblock Detected

Please support us by disabling your AdBlocker extension from your browsers for our website.