Salesforce Tells Clients It Won’t Pay Hackers for Extortion

Core Viewpoint - Salesforce Inc. has decided not to pay a ransom demanded by hackers who claimed to have stolen a significant amount of client data, as indicated in a security notification sent to customers [1][3]. Group 1: Incident Overview - The hacking group known as ShinyHunters is believed to have stolen data from a third-party app, SalesLoft's Drift app, which integrates with Salesforce for automating customer service interactions [2][4]. - The breach involved the theft of customer contact information, basic IT support data, access tokens for user authorization, and details about customers' IT configurations [5][6]. Group 2: Company Response - Salesforce has stated it will not engage in negotiations or pay any extortion demands and is in contact with affected customers to provide support [3][7]. - The company has re-enabled integrations with SalesLoft technologies but has kept the Drift app disabled following the incident [7]. Group 3: Security Context - Google Threat Intelligence Group had previously warned businesses about a data theft campaign targeting Salesforce customer instances through the SalesLoft Drift app between August 8 and August 15 [6]. - The hackers targeted sensitive credentials, passwords, and some database access tokens during this campaign [6].