Google has confirmed that hackers created a fraudulent account in its Legislation Enforcement Request System (LERS) platform that regulation enforcement makes use of to submit official knowledge requests to the corporate
“We’ve got recognized {that a} fraudulent account was created in our system for regulation enforcement requests and have disabled the account,” Google instructed BleepingComputer.
“No requests had been made with this fraudulent account, and no knowledge was accessed.”
The FBI declined to touch upon the menace actor’s claims.
This assertion comes after a bunch of menace actors calling itself “Scattered Lapsus$ Hunters” claimed on Telegram to have gained entry to each Google’s LERS portal and the FBI’s eCheck background examine system.
The group posted screenshots of their alleged entry shortly after saying on Thursday that they had been “going darkish.”
The hackers’ claims raised considerations as each LERS and the FBI’s eCheck system are utilized by police and intelligence businesses worldwide to submit subpoenas, courtroom orders, and emergency disclosure requests.
Unauthorized entry might enable attackers to impersonate regulation enforcement and acquire entry to delicate person knowledge that ought to usually be protected.
The “Scattered Lapsus$ Hunters” group, which claims to encompass members linked to the Shiny Hunters, Scattered Spider, and Lapsus$ extortion teams, is behind widespread knowledge theft assaults focusing on Salesforce knowledge this 12 months.
The menace actors initially utilized social engineering scams to trick staff into connecting Salesforce’s Information Loader device to company Salesforce cases, which was then used to steal knowledge and extort corporations.
The menace actors later breached Salesloft’s GitHub repository and used Trufflehog to scan for secrets and techniques uncovered within the non-public supply code. This allowed them to seek out authentication tokens for Salesloft Drift, which had been used to conduct additional Salesforce knowledge theft assaults.
These assaults have impacted many corporations, together with Google, Adidas, Qantas, Allianz Life, Cisco, Kering, Louis Vuitton, Dior, Tiffany & Co, Cloudflare, Zscaler, Elastic, Proofpoint, JFrog, Rubrik, Palo Alto Networks, and many extra.
Google Risk Intelligence (Mandiant) has been a thorn within the facet of those menace actors, being the first to reveal the Salesforce and Salesloft assaults and warning corporations to shore up their defenses.
Since then, the menace actors have been taunting the FBI, Google, Mandiant, and safety researchers in posts to numerous Telegram channels.
Late Thursday evening, the group posted a prolonged message to a BreachForums-linked area inflicting some to consider the menace actors had been retiring.
“That is why we’ve got determined that silence will now be our energy,” wrote the menace actors.
“You may even see our names in new databreach disclosure stories from the tens of different multi billion greenback corporations which have but to reveal a breach, in addition to some governmental businesses, together with extremely secured ones, that doesn’t imply we’re nonetheless lively.”
Nonetheless, cybersecurity researchers who spoke with BleepingComputer consider the group will proceed conducting assaults quietly regardless of their claims of going darkish.
46% of environments had passwords cracked, practically doubling from 25% final 12 months.
Get the Picus Blue Report 2025 now for a complete have a look at extra findings on prevention, detection, and knowledge exfiltration traits.
