The incident is one of several breaches affecting Salesforce in 2025. A group calling itself “Scattered LAPSUS$ Hunters” released a limited sample of the stolen database on October 3 2025. The records have since been indexed and anonymized in our search engine. According to the attackers the full dataset is scheduled for release on October 10 2025.

Data found in hackers’ sample – 🧍 Personal Information

Full name – ✅ Present Email address – ✅ Present Phone number – ✅ Present Mailing address (street city state ZIP country) – ✅ Present Gender – ⛔ Empty Date of birth / age – ⛔ Empty Nationality – ✅ Present (U.S.-based contact)

🏢 , Company / Business Information

Company name – ✅ Present Industry – ✅ Present (“Construction”) Website – ✅ Present Billing address (street city state ZIP country) – ✅ Present Number of employees – ✅ Present Annual revenue – ✅ Present Account / customer status – ✅ Present (“Active”) Customer development stage – ✅ Present (“Won”) Broker or account owner name – ✅ Present, Division / area code – ✅ Present (internal code “A63-Corp Departments”)

🪪 , Identification Data

Internal Salesforce record IDs – ✅ Present (AccountId ContactId UserId) Customer profile / hub ID – ✅ Present RecordTypeId – ✅ Present Customer number – ⛔ Empty External government or personal ID – ⛔ Empty

📧 , Contact Information

Customer email – ✅ Present Customer service email – ✅ Present Work phone and customer service phone – ✅ Present Alternate phone – ⛔ Empty Fax – ⛔ Empty

💬 , Customer Status & Marketing

Lead source – ✅ Present (“Business Card”) Contact status – ✅ Present (“Active”) Preferred contact method – ✅ Present (“Phone”) Marketing opt-out flags – ✅ Present (false / not opted out) Email verification status – ✅ Present (“Invalid”) BriteVerify phone validation – ✅ Present (“Valid”) NAC / Marketing flags – ✅ Present (false)

💳 , Account & Contract Data

Account source – ✅ Present (“Zoominfo”) Revenue / potential revenue fields – ✅ Present (multiple numeric fields) National account flag – ✅ Present (true) Special waste / service flags – ✅ Present (true/false values) Active customer flag – ✅ Present (true) Purchase order required – ✅ Present (false) Approval required – ✅ Present (false) Risk / at-risk status – ✅ Present (“No”) VIP customer flag – ✅ Present (false)

👨‍💼 , Employee / User Data

Internal employee name – ✅ Present Internal email – ✅ Present Username / alias / community nickname – ✅ Present User role and profile name – ✅ Present (“Sales User”) Department / job title – ⛔ Empty Active / inactive status – ✅ Present (inactive in sample) Time zone and locale – ✅ Present Last login date – ✅ Present (historical) Password expiration – ✅ Present (historic timestamp)

Record creation and modification timestamps – ✅ Present Created by / modified by user IDs – ✅ Present SystemModstamp (sync timestamps) – ✅ Present Photo URLs and user banners – ✅ Present IsDeleted / IsPriorityRecord flags – ✅ Present (false) Owner IDs – ✅ Present Portal and partner flags – ✅ Present (false) Digest frequency email encoding, and locale – ✅ Present

⚖️ , Privacy & Legal Fields

Opt-out flags – ✅ Present (false) Email verification flags – ✅ Present (false / invalid) Refused flag – ✅ Present (false) Divest / deactivation flags – ✅ Present (false) No right-to-delete or explicit consent date fields – ⛔ Empty