In early October 2025, reports surfaced that a hacker group called “Scattered LAPSUS$ Hunters” claimed to have stolen nearly 1 billion records from Salesforce. The alleged data includes personally identifiable information (PII) from multiple major brands, including Marks & Spencer, Co-op, and Jaguar Land Rover. However, Salesforce insists its systems were not breached.

The Real Issue: Social Engineering, Not a System Breach

Salesforce quickly clarified that its platform remains uncompromised. Instead, the hackers reportedly exploited human vulnerabilities through vishing, or voice phishing — a form of social engineering. In these attacks, cybercriminals impersonate employees or IT staff over the phone to trick victims into granting unauthorized access.

This reveals that even the most secure cloud infrastructures can be undermined if employee awareness and verification protocols are weak. The breach wasn’t about breaking firewalls — it was about breaking trust.

The Problem: Human Error in Cybersecurity

The incident underscores a recurring theme in cybersecurity: technology is often not the weakest link — people are. Attackers exploited trust, familiarity, and urgency to deceive employees into giving away access or installing compromised tools, such as a fake Salesforce Data Loader.

This highlights how critical it is for companies to implement continuous employee training, strong verification procedures, and multi-factor authentication for all internal processes, especially those involving sensitive customer data.

What We Can Learn: Strengthening the Human Firewall

The Salesforce incident is a powerful reminder that cybersecurity is not just an IT department’s job — it’s everyone’s responsibility. Organizations should prioritize regular social engineering awareness training, simulate phishing tests, and enforce strict identity verification before any access or data action is approved.

Technology can protect systems, but vigilance and training protect people. As cybercriminals become more sophisticated, the best defense will always be an informed and alert workforce.

The Bigger Picture: Trust, Cloud Security, and the Future

The claim of “1 billion stolen records” shakes confidence in cloud-based platforms, even when the platform itself isn’t at fault. For Salesforce and its clients, this event highlights the importance of shared responsibility — cloud providers must secure their infrastructure, while customers must safeguard how they use it.

Ultimately, this isn’t just a Salesforce story — it’s a wake-up call for every business that handles customer data in the digital age.