ShinyHunters Leak Alleged Data from Qantas, Vietnam Airlines and Other Major Firms

The 'Scattered Lapsus$ Hunters' hacking group has published extensive customer and internal business data from six major companies, including Qantas Airways and Vietnam Airlines, after claiming to have exploited a Salesforce vulnerability to compromise 989 million records from 39 global firms. This significant data release, which includes sensitive PII and internal CRM details, exposes affected individuals to identity theft and poses substantial reputational and financial risks for the involved corporations. The incident underscores critical cybersecurity vulnerabilities within third-party CRM platforms like Salesforce, raising concerns for institutional investors regarding data governance and operational resilience across a broad spectrum of industries.

Analysis

A hacking collective, "Scattered Lapsus$ Hunters," has published sensitive data from six major corporations, including Qantas Airways and Vietnam Airlines, following claims of exploiting a Salesforce vulnerability to compromise 989 million records from 39 global firms. This initial release on October 10, 2025, includes substantial datasets, such as Qantas's 153 GB with over 5 million records and Vietnam Airlines' 63.62 GB with more than 23 million records, underscoring a significant cybersecurity breach.

The leaked information is highly sensitive, encompassing extensive Personally Identifiable Information (PII) like passport numbers, frequent flyer details, full names, addresses, and internal CRM fields. Qantas Airways has confirmed that data from 5.7 million customers was published online, validating the severity of the breach and creating substantial risks for affected individuals, including identity theft and fraud.

For the implicated companies, which span retail (GAP, Albertsons), logistics (UPS, FedEx), and automotive (Toyota, Stellantis), the breach poses significant reputational damage, potential financial liabilities, and regulatory scrutiny. The incident also raises critical questions regarding the security posture of third-party cloud service providers, particularly Salesforce (CRM), whose alleged vulnerability was central to the attack. The overall sentiment is extremely negative, with a high market impact score of 0.85.

Key Decisions for Investors

• Investors should immediately assess their portfolio for direct and indirect exposure to the 39 named companies and Salesforce (CRM), evaluating potential financial and reputational impacts.
• Scrutinize the cybersecurity governance and data protection measures of companies within their holdings, especially those reliant on third-party cloud CRM solutions.
• Anticipate increased legal actions, regulatory fines, and potential class-action lawsuits against affected companies, which could impact future earnings and stock performance.
• Monitor for broader sector-wide implications for cloud service providers and companies heavily dependent on external data management, as this incident may prompt re-evaluation of vendor security protocols.