Scattered Lapsus$ Hunters Leaked Data From Six Companies and Plans Ransomware Service
Summary
Scattered Lapsus$ Hunters extorted companies over alleged Salesforce data theft, leaked data from six victims, and announced a ransomware-as-a-service platform called ShinySp1d3r.
Key points
- The group reportedly combines members of ShinyHunters, Scattered Spider, and Lapsus$.
- In October 2025, it threatened 39 companies it said were affected by Salesforce breaches and demanded payment from Salesforce.
- The group later leaked data from six companies; Qantas and Vietnam Airlines each reportedly had more than five million customer records exposed.
- In November 2025, the group announced ShinySp1d3r, a ransomware-as-a-service platform reportedly under development.
- Samples uploaded to VirusTotal reportedly include common and newly developed features; encrypted files contain negotiation instructions and a TOX contact address.
- The group claimed its encryptor would exclude healthcare organizations, but researchers cautioned that similar pledges by other groups have not always been honored.
Article Details
- Event Type
- Cyber extortion and data-leak campaign attributed to Scattered Lapsus$ Hunters, alongside its announcement of a ransomware-as-a-service platform in development.
- Impact
- The group reportedly extorted 39 companies affected by Salesforce breaches and later leaked data from six. Qantas and Vietnam Airlines each had more than five million customer records exposed. The group also threatened further activity and announced ShinySp1d3r, a ransomware platform that it said was in development.
Threat Actors
LAPSUS$Reportedly one of the groups whose extortion members formed Scattered Lapsus$ Hunters.Scattered Lapsus$ HuntersHybrid threat actor group reportedly formed from members of ShinyHunters, Scattered Spider, and Lapsus$; attributed to the Salesforce-related extortion and data leaks.Scattered SpiderReportedly one of the groups whose members formed Scattered Lapsus$ Hunters; the article also describes its members as arrested in 2024 and the group as reemerging in 2025.ShinyHuntersReportedly one of the groups whose members formed Scattered Lapsus$ Hunters; the article says ShinyHunters would lead development of ShinySp1d3r.
Malware
DragonForcePreviously, these threat actors have used ransomware encryptors such as Qilin, RansomHub, and DragonForce.QilinPreviously, these threat actors have used ransomware encryptors such as Qilin, RansomHub, and DragonForce.RansomHubPreviously, these threat actors have used ransomware encryptors such as Qilin, RansomHub, and DragonForce.shinysp1d3rIn November 2025, the group announced the development of a Ransomware-as-a-Service (RaaS) platform named, ShinySp1d3r.
Vendors
Products
Countries
AustraliaThey warn against policies that mirror Australia’s “Cyber Security Act of 2024” which introduced mandatory reporting of ransomware and cyber extortion payments, as well as strongly discouraging complying with threatVietnamThe victims included Albertsons, Engie Resources, Fujifilm, Gap, Qantas, and Vietnam Airlines.
Industries
HealthcareShinyHunters claims that organizations in the healthcare sector, including pharmaceutical companies, hospitals, clinics, and insurance providers, are excluded from being targeted by its encryptor.pharmaceuticalShinyHunters claims that organizations in the healthcare sector, including pharmaceutical companies, hospitals, clinics, and insurance providers, are excluded from being targeted by its encryptor.