The hackers used social engineering tactics known as “vishing” or voice phishing. Criminals used AI to impersonate IT support personnel and convinced employees at a Manila-based Qantas call centre and other companies to install modified software that appeared to be Salesforce’s legitimate Data Loader tool. This provided access to customer databases stored within those organisations’ Salesforce accounts.
Loading
Salesforce provides customer relationship management software used by thousands of companies to store customer data, making it an attractive target for cybercriminals seeking large-scale data theft.
At Dreamforce, Salesforce said it took a “shared responsibility” model to security, arguing customers must properly configure security settings the platform provides.
“We are a global team that works 24 hours a day, seven days a week, monitoring, detecting and responding to all security events,” said Kelly McCracken, who leads the company’s Cyber Security Operations Centre.
“Our customers are able to customise their [settings] to meet their business needs, and they must configure them to ensure that they keep their data secure.”
She said that in the event of a data breach involving a customer, Salesforce partners directly in the investigation and remediation, feeding incident data back to its threat-intel team to shore up platform-wide defences.
The hacking group responsible, identified as Scattered Lapsus$ Hunters, had set an October 10 deadline for companies to begin ransom negotiations. When companies declined to pay, the group began releasing stolen data. A Salesforce spokesman said the company would not engage, negotiate with, or pay any extortion demand.
The Qantas breach, which occurred on June 30, exposed customer names, addresses, phone numbers, email addresses and frequent flyer information, though no credit card details or passport numbers were compromised. Qantas has obtained an injunction from the NSW Supreme Court limiting public disclosure of affected customer details.
Qantas is urging affected customers to remain vigilant about scams and has established a 24/7 support line. The airline advises customers to independently verify any communications claiming to be from Qantas and to use two-factor authentication on their accounts. Security experts warn that criminals may cross-reference the Qantas data with other breached databases to create more targeted scam campaigns.
The attacks are considered separate from another incident in August involving Salesforce integration software, which security researchers say may have affected hundreds of additional companies. Both incidents remain under investigation by law enforcement and cybersecurity firms.
David Swan travelled to San Francisco as a guest of Salesforce.
The Business Briefing newsletter delivers major stories, exclusive coverage and expert opinion. Sign up to get it every weekday morning.
