Vietnam Airlines data breach

[Flashback]

Another one, quite a lot of data exposed this time. 7.32 million accounts.

Compromised Data: Dates of birth, Email addresses, Loyalty program details, Names, Phone numbers
Description: In October 2025, data stolen from the Salesforce instances of multiple companies by a hacking group calling itself "Scattered LAPSUS$ Hunters" was publicly released. Among the affected organisations was Vietnam Airlines, which had 7.5M unique customer email addresses exposed following a breach of its Salesforce environment in June of that year. The compromised data also included names, phone numbers, dates of birth, and loyalty program membership numbers.

 

[33kft]

It's the same threat actor that compromised Qantas, likely similar playbook - target a call centre employee and exfiltrate all the customer data.

The part that customers should be frustrated about is that it was released now because a ransom wasn't paid, just like in Qantas's case. The company absolutely knew they had been compromised, if it is news to customers today that means they did not inform customers.

 

[moa999]

Whats worse is in this case it appears it was a single breach into salesforces systems through which they were able to access multiple databases belonging to other companies.

Anyhow it's nothing compared to the 2014-2018 hack on Starwood/ Marriott where reportedly Chinese state associated actors used the hack to build profiles on key political and business people

 

[33kft]

Whats worse is in this case it appears it was a single breach into salesforces systems through which they were able to access multiple databases belonging to other companies.

I'm certain that's not the case, they did it via a social engineering attack and a malicious Salesforce app, but it wasn't a breach of Salesforce's systems:

Salesforce says it won’t pay extortion demand in 1 billion records breach

Scattered LAPSUS$ Hunters gave Salesforce until Friday to pay or else.

arstechnica.com

Highlights the challenges faced when a platform allows integration between 3rd party apps and CRM data, but those 3rd party apps absolutely need to be able to read CRM data. The fact it seems Salesforce doesn't seem to have any controls to avoid large scale exfiltration is a failure in my opinion but I'm sure they'd tell you it is a feature, or sell you overpriced ineffective security add-ons instead.