Republic Services, one of the largest waste management companies in the United States, was caught up in a 2025 supply chain attack targeting Salesforce cloud environments. A threat group calling itself "Scattered LAPSUS$ Hunters" claimed responsibility and published a sample of stolen data on October 3, 2025, with the full dataset reportedly scheduled for release on October 10. The breach exposed records tied to an estimated 40.9 million customers. The exposed data includes full names, email addresses, phone numbers, and mailing addresses. Because Republic Services provides residential waste collection, home addresses in this dataset carry an added risk: they can be combined with service schedules to build detailed routine-of-life profiles, revealing when residents are likely away from home. The data also included business account details such as company names, billing addresses, employee counts, revenue figures, and internal account identifiers from the Salesforce platform. Republic Services has not made detailed public statements about the incident, and no major regulatory action or litigation specific to this breach has been documented. Affected individuals should be alert to phishing attempts by email or phone, as the combination of verified contact details and service location information makes targeted scams more convincing. Residential customers in particular should be aware that their address data is now likely in broad circulation.

Waste-management and environmental-service firms collect customer, employee, vendor, route, billing, and service-location records across operational and municipal-service workflows.

Republic Services has continued investing in sustainability infrastructure and fleet electrification as part of its publicly stated environmental strategy. The company has maintained stable financial performance and is considered one of the more defensively positioned companies in the industrial services sector. No major leadership changes or structural events beyond the breach itself have been prominently reported in the 12-18 months prior to publication.