Overview

• The Scattered Lapsus$ Hunters collective posted more than 150 GB tied to about five million Qantas records after its Oct. 11 deadline, despite U.S.-French seizures of BreachForums’ public domains.
• Qantas says the leak includes names, contact details, birth dates and frequent flyer numbers, not credit card data or identity documents, and it reports no impact to frequent flyer accounts.
• Only six companies’ datasets were posted initially — Qantas, Vietnam Airlines, Gap, Albertsons, Fujifilm and Engie — though the group lists dozens of additional victims from its Salesforce‑related campaign.
• Salesforce states there is no indication its core platform was compromised and says it will not pay an extortion demand, with reporting pointing to social‑engineering of third‑party helpdesks and abused integrations as the entry point.
• Cybersecurity experts warn the forum seizure will not prevent further distribution, noting the data has already been mirrored to a new clear‑web site and could fuel phishing and identity‑fraud attempts.