Free tools Windows power users keep installed
One-click scans. No signup required.
Salesforce said it would not negotiate with or pay an extortion demand tied to data that attackers claimed involved 989.45 million records. That figure was the threat group’s claim, not an independently verified count. Contemporary reporting linked some of the data access to stolen tokens from Salesloft’s Drift application, which integrates with Salesforce—not to a confirmed compromise of Salesforce’s core platform.
Did Salesforce refuse to pay a ransom?
Yes. Salesforce spokesperson Allen Tsai told The Register: “Salesforce will not engage, negotiate with, or pay any extortion demand.” Salesforce said it was supporting customers it believed were affected.
Did Salesforce get hacked?
Salesforce said it had no indication its platform had been compromised. In an October 2, 2025 incident update quoted by The Register, the company said: “At this time, there is no indication that the Salesforce platform has been compromised, nor is this activity related to any known vulnerability in our technology.” It described the extortion attempts as related to past or unsubstantiated incidents.
How the reported access occurred
The Register reported that some data theft was linked to an earlier compromise of Salesloft’s Drift application. Drift integrates with Salesforce; attackers reportedly stole OAuth tokens and used them to access multiple Salesforce customer instances. This account concerns access through a third-party integration and stolen credentials. It does not establish that attackers exploited a vulnerability in Salesforce’s core platform.
Recommended Free Tools
#1 Best Overall
- Hardware encrypted drive
- Simple to use pin access. RPM-5400
- Administrator password feature
- Bus powered
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
What does “1 billion records” mean?
The threat group, Scattered LAPSUS$ Hunters, claimed it had 989.45 million records, according to The Register’s October 2025 report. That is the source of the rounded “1 billion” figure; it is an attacker claim, not an audited or independently confirmed total. Information Security Media Group likewise described the figures as claims in its October 9 report.
What was the reported timeline?
- October 2, 2025: Salesforce issued the incident update quoted by The Register, saying there was no indication its platform had been compromised or that a known Salesforce technology vulnerability was involved.
- October 3, 2025: The Register reported that the group listed 39 companies’ Salesforce environments on its leak site.
- October 10, 2025: The group reportedly set this as its deadline for Salesforce to negotiate before data would be leaked. The contemporaneous reports cited here do not establish what happened after that date.
SANS NewsBites also summarized Salesforce’s refusal and noted that the demand concerned data from earlier intrusions, including the Salesloft Drift breach (October 10, 2025 issue).
Quick Recap
Rank #4
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Rank #2
- Utilizes Military Grade FIPS PUB 197 Validated Encryption Algorithm
- Super fast USB 3.0 Connection - Data transfer speeds up to 10X faster than USB 2.0
- Software Free Design - With no admin rights needed
- Sealed from Physical Attacks by Tough Epoxy Coating
- Brute Force Self Destruct Feature
What is confirmed—and what remains unknown?
- Confirmed as Salesforce’s stated position: It would not negotiate or pay, and it said it was supporting affected customers.
- Reported, but not independently verified: The group’s 989.45 million-record claim, the list of 39 company environments, and the October 10 deadline.
- Not established by the cited contemporaneous reports: Whether the threatened data was published after the deadline, the final verified exposure scope, or an independently confirmed record count.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
