Through 2025, a financially motivated group used phone calls to talk employees into connecting a malicious app to their company's Salesforce tenant. Once the app was authorised, it pulled customer records out in bulk through the Salesforce API, and the data was later used for extortion under the ShinyHunters name. Google, Allianz Life, Qantas, Cisco and dozens of other organisations were caught up in it. Salesforce itself was not breached and no platform vulnerability was used. The weak point was how easily a person on the phone could approve a new machine identity, an OAuth connected app, with broad access to CRM data.
Key takeaways
- The FBI says the group Google tracks as UNC6040 has used social engineering against Salesforce customers since October 2024. Callers posed as IT support and guided staff to approve a connected app, often a modified version of Salesforce's Data Loader.
- The approved app became a persistent, API-level identity in the tenant. Google says it was used to query and exfiltrate whole tables, and in some cases the stolen credentials were then used against Okta and Microsoft 365.
- Extortion, tracked by Google as UNC6240, sometimes followed months later, with the caller or emailer claiming to be ShinyHunters. In October 2025 a leak site listed 39 companies and demanded that Salesforce pay to stop the release of about 1 billion records, a claim Salesforce refused to entertain.
- Qantas said 5.7 million customers were affected. Allianz Life said the attacker obtained data on the majority of its 1.4 million customers. Google said one of its own corporate Salesforce instances was hit.
- The core control failure was that ordinary users could approve new connected apps. Allowlisting OAuth apps, restricting who can authorise them and watching for bulk API exports would have broken the chain.
At a glance
| Organisations | Salesforce customers including Google, Allianz Life, Qantas and Cisco; 39 companies named on the October 2025 leak site |
|---|---|
| When | Activity since October 2024 (FBI); first public warning 4 June 2025 (Google); victim disclosures from July 2025; leak site launched in early October 2025 |
| Attacker | UNC6040 (intrusion) and UNC6240 (extortion) in Google's tracking, using the ShinyHunters name; the October 2025 leak site was run under the name "Scattered Lapsus$ Hunters" |
| Entry point | Voice phishing of employees and call centre staff, who were talked into approving a malicious connected app and in some cases handing over credentials and MFA codes |
| Identities abused | Malicious OAuth connected apps (modified Data Loader, later custom Python tools) authorised into Salesforce tenants; employee Salesforce, Okta and Microsoft 365 credentials |
| Impact | Bulk theft of CRM data from many organisations; 5.7 million Qantas customers; most of Allianz Life's 1.4 million customers; claimed total of about 1 billion records |
| Category | NHI (malicious OAuth connected apps) combined with human identity (voice phishing) |
What happened
On 4 June 2025, Google Threat Intelligence Group (GTIG) described a cluster it calls UNC6040, "a financially motivated threat cluster that specializes in voice phishing (vishing) campaigns specifically designed to compromise organizations' Salesforce instances for large-scale data theft and subsequent extortion." Callers impersonated IT support. During the call they walked the employee to Salesforce's connected app setup page and asked them to enter a "connection code", which linked an attacker-controlled app to the company's tenant. GTIG says the app was "often a modified version of Salesforce's Data Loader", sometimes renamed to fit the pretext, with one example called "My Ticket Portal". The group later moved to custom Python scripts that did the same job.
GTIG was clear that "in all observed cases, attackers relied on manipulating end users, not exploiting any vulnerability inherent to Salesforce." The same infrastructure hosted an Okta phishing panel, and the callers also asked directly for credentials and MFA codes. After the Salesforce theft, GTIG saw the group use harvested credentials to move to other cloud services, including Okta and Microsoft 365.
Extortion came separately and sometimes months later. GTIG tracks it as UNC6240: calls or emails to staff demanding bitcoin within 72 hours, from actors who "consistently claimed to be the threat group ShinyHunters." The FBI's FLASH alert of 12 September 2025 describes the same pattern and dates it to October 2024.
Victims surfaced through the summer. Qantas said on 2 July 2025 that a cybercriminal had "targeted a call centre and gained access to a third party customer servicing platform", and a week later put the number of affected customers at 5.7 million. Qantas did not name the platform; BleepingComputer reported that the Qantas breach was part of the Salesforce campaign. Allianz Life said an attacker used social engineering on 16 July 2025 to reach a third-party, cloud-based CRM system and obtained data on "the majority of Allianz Life's customers, financial professionals, and select Allianz Life employees." Cisco said a representative was targeted by vishing on 24 July 2025, leading to the export of basic Cisco.com user profile data from a third-party CRM. On 5 August 2025 Google added that "one of Google's corporate Salesforce instances was impacted by similar UNC6040 activity" in June, exposing largely public business contact data.
On 3 October 2025, a group calling itself Scattered Lapsus$ Hunters launched a leak site naming 39 companies, including Google, Cisco, Toyota, FedEx, Disney, Air France and KLM, Adidas and Chanel, and demanding that Salesforce pay to stop the release of about 1 billion records. Salesforce said: "I can confirm Salesforce will not engage, negotiate with or pay for any extortion demand." The FBI and French authorities seized a BreachForums domain used by the group on 10 October, but the Tor leak site stayed up, and on 11 October ABC News reported that Qantas customer data had been released.
This campaign is separate from the August 2025 theft of Salesloft Drift OAuth tokens, tracked by Google as UNC6395, which also targeted Salesforce data. We cover that incident in Salesloft Drift OAuth token breach.
Timeline
| Date | Event |
|---|---|
| October 2024 | UNC6040 social engineering against Salesforce customers begins, according to the FBI. |
| 4 June 2025 | Google Threat Intelligence Group publishes its UNC6040 analysis. |
| June 2025 | One of Google's corporate Salesforce instances is accessed. |
| 2 July 2025 | Qantas discloses unauthorised access to a third party customer servicing platform used by a contact centre. |
| 9 July 2025 | Qantas confirms 5.7 million unique customers affected. |
| 16 July 2025 | Attacker reaches Allianz Life's third-party cloud CRM through social engineering. |
| 24 July 2025 | A Cisco representative is targeted by vishing; Cisco discloses on 1 August. |
| 5 August 2025 | Google confirms one of its own Salesforce instances was affected. |
| 12 September 2025 | FBI issues FLASH alert on UNC6040 and UNC6395. |
| 3 October 2025 | Leak site lists 39 victims and demands a ransom from Salesforce. |
| 10 October 2025 | FBI and French authorities seize a BreachForums domain used by the group. |
| 11 October 2025 | Qantas customer data is released on the dark web. |
How it happened: the identity attack path
- A human is persuaded by phone. A caller posing as IT support contacts an employee, often in a call centre or support role, with a plausible reason to "fix" something.
- The human approves a machine identity. The employee opens Salesforce's connected app setup page and enters a connection code. That single approval registers the attacker's app as an OAuth client with access to the tenant under the employee's authority.
- The app looks legitimate. It is a modified Data Loader, a real Salesforce tool, renamed to suit the story (for example "My Ticket Portal"). Nothing in the approval screen forces a second person to check it.
- Bulk API export. With the app connected, the attacker runs API queries. GTIG saw small test queries followed by the extraction of entire tables, from Mullvad VPN and Tor addresses.
- Credentials reused elsewhere. Where the caller also collected passwords and MFA codes, the attacker used them to reach Okta, Microsoft 365 and other cloud services.
- Extortion later. Stolen data is held, sometimes for months, then used for ransom demands and finally published on a leak site.
Impact
- Qantas: 5.7 million unique customers, including names, email addresses, Frequent Flyer details and, for some, addresses, dates of birth and phone numbers. Qantas said no credit card, passport or login details were taken.
- Allianz Life: data on the majority of its 1.4 million customers, plus financial professionals and some employees. Have I Been Pwned later put the figure at 1.1 million, as reported by Security Affairs.
- Google: business names and contact details for small and medium business contacts from one corporate Salesforce instance.
- Cisco: basic profile data of Cisco.com registered users.
- Wider campaign: 39 companies listed on the leak site and a claimed total of about 1 billion records, according to BleepingComputer's reporting of the attackers' claims.
What this means for NHI governance
This is usually described as a vishing campaign, and the first move was human. But the thing that stayed in the tenant and did the stealing was a non-human identity: an OAuth connected app with API access to CRM data. The phone call only had to succeed once. After that, the attacker did not need the employee, their password or their MFA again, because the app had its own authorised access.
Most organisations govern who can log in to Salesforce far more tightly than they govern which apps users can connect to it. Connected apps are often approved by whoever happens to be using the system, with no inventory, no owner and no review. That is the same weakness behind OAuth supply chain incidents such as Salesloft Drift, where the app was legitimate but its tokens were stolen. In both cases, the question an organisation needs to be able to answer is simple: which apps can read our CRM data, who approved them and what have they done recently?
The campaign also shows why bulk data access by an app should be treated as a high-risk event. A new client exporting whole tables through the API from a VPN exit node is not normal behaviour for any tenant, and it can be detected.
Recommendations
- Stop users approving new connected apps. Restrict permissions such as "Manage Connected Apps" and "Customize Application" to a small administrative group and allowlist approved apps, as Google recommends.
- Inventory every OAuth app and integration. Record the owner, scopes and business purpose of each connected app and remove anything unknown. Our NHI Lifecycle Management Guide covers ownership and review.
- Limit API and bulk export rights. Assign "API Enabled" and mass data permissions only to users and integrations that need them.
- Restrict where access can come from. Apply login IP ranges and trusted networks so connections from commercial VPNs and Tor are refused.
- Monitor for bulk downloads. Use event monitoring and transaction security policies to alert on, or block, large exports by any user or app.
- Train support staff for this exact script. No legitimate IT call should ask someone to enter a connection code or read out an MFA code. Our Workforce Identity Security Guide covers help desk and verification controls.
Frequently asked questions
Was Salesforce hacked in the ShinyHunters campaign?
No. Google, the FBI and Salesforce all say the attackers used social engineering against customer employees, not a vulnerability in the Salesforce platform. Each victim's own tenant was accessed through an app its staff had been tricked into approving.
What is a malicious connected app in Salesforce?
A connected app is an external application authorised through OAuth to access Salesforce data. In this campaign the attackers used a modified version of Salesforce's Data Loader, and later custom scripts, which employees approved during phone calls, giving the attackers API access to the tenant.
Is this the same as the Salesloft Drift breach?
No. Both targeted Salesforce data in 2025, but the Salesloft Drift incident, tracked by Google as UNC6395, used OAuth tokens stolen from a legitimate third-party integration. This campaign, UNC6040, relied on vishing employees into approving a malicious app.
Related NHI Mgmt Group resources
Salesloft Drift OAuth token breach · Klue OAuth supply chain breach · Snowflake breach · Co-op Group breach, Scattered Spider · Top 10 NHI Issues
How NHI Mgmt Group can help
Securing Non-Human Identities (NHIs), including AI agents, is becoming increasingly crucial as attackers target OAuth apps, SaaS integrations, API keys, tokens and service accounts, often by persuading a person to create or approve them. Our NHI Foundation Level Training Course gives teams the practical grounding to find, govern and protect these identities.
References
- Google Threat Intelligence Group: The Cost of a Call, From Voice Phishing to Data Extortion (4 June 2025, updated 8 August 2025)
- FBI: FLASH, Cyber Criminal Groups UNC6040 and UNC6395 Compromising Salesforce Instances for Data Theft and Extortion (12 September 2025)
- Qantas: Qantas cyber incident (2 July 2025)
- Qantas: Update on Qantas cyber incident, Wednesday 9 July 2025 (9 July 2025)
- TechCrunch: Allianz Life says majority of customers' personal data stolen in cyberattack (26 July 2025)
- Security Affairs: Allianz Life security breach impacted 1.1 million customers (19 August 2025)
- Cisco: Vishing Attack Impacting Third-Party CRM System (1 August 2025)
- BleepingComputer: ShinyHunters behind Salesforce data theft attacks at Qantas, Allianz Life, and LVMH (30 July 2025)
- BleepingComputer: ShinyHunters launches Salesforce data leak site to extort 39 victims (3 October 2025)
- Cybersecurity Dive: Salesforce refuses to submit to extortion demands linked to hacking campaigns (8 October 2025)
- BleepingComputer: FBI takes down BreachForums portal used for Salesforce extortion (10 October 2025)
- ABC News: Hackers release Qantas customers' data on dark web (11 October 2025)
