Google has confirmed that hackers created a fraudulent account in its Regulation Enforcement Request System (LERS) platform that regulation enforcement makes use of to submit official knowledge requests to the corporate
“We now have recognized {that a} fraudulent account was created in our system for regulation enforcement requests and have disabled the account,” Google informed BleepingComputer.
“No requests have been made with this fraudulent account, and no knowledge was accessed.”
The FBI declined to touch upon the menace actor’s claims.
This assertion comes after a bunch of menace actors calling itself “Scattered Lapsus$ Hunters” claimed on Telegram to have gained entry to each Google’s LERS portal and the FBI’s eCheck background verify system.
The group posted screenshots of their alleged entry shortly after asserting on Thursday that they have been “going darkish.”
The hackers’ claims raised issues as each LERS and the FBI’s eCheck system are utilized by police and intelligence companies worldwide to submit subpoenas, court docket orders, and emergency disclosure requests.
Unauthorized entry might permit attackers to impersonate regulation enforcement and achieve entry to delicate consumer knowledge that ought to usually be protected.
The “Scattered Lapsus$ Hunters” group, which claims to include members linked to the Shiny Hunters, Scattered Spider, and Lapsus$ extortion teams, is behind widespread knowledge theft assaults focusing on Salesforce knowledge this 12 months.
The menace actors initially utilized social engineering scams to trick staff into connecting Salesforce’s Information Loader software to company Salesforce situations, which was then used to steal knowledge and extort firms.
The menace actors later breached Salesloft’s GitHub repository and used Trufflehog to scan for secrets and techniques uncovered within the personal supply code. This allowed them to seek out authentication tokens for Salesloft Drift, which have been used to conduct additional Salesforce knowledge theft assaults.
These assaults have impacted many firms, together with Google, Adidas, Qantas, Allianz Life, Cisco, Kering, Louis Vuitton, Dior, Tiffany & Co, Cloudflare, Zscaler, Elastic, Proofpoint, JFrog, Rubrik, Palo Alto Networks, and many extra.
Google Menace Intelligence (Mandiant) has been a thorn within the facet of those menace actors, being the first to reveal the Salesforce and Salesloft assaults and warning firms to shore up their defenses.
Since then, the menace actors have been taunting the FBI, Google, Mandiant, and safety researchers in posts to varied Telegram channels.
Late Thursday evening, the group posted a prolonged message to a BreachForums-linked area inflicting some to imagine the menace actors have been retiring.
“That is why we’ve got determined that silence will now be our power,” wrote the menace actors.
“You might even see our names in new databreach disclosure studies from the tens of different multi billion greenback firms which have but to reveal a breach, in addition to some governmental companies, together with extremely secured ones, that doesn’t imply we’re nonetheless energetic.”
Nonetheless, cybersecurity researchers who spoke with BleepingComputer imagine the group will proceed conducting assaults quietly regardless of their claims of going darkish.
Replace 9/15/25: Article title up to date as some felt it indicated a breach.
46% of environments had passwords cracked, almost doubling from 25% final 12 months.
Get the Picus Blue Report 2025 now for a complete take a look at extra findings on prevention, detection, and knowledge exfiltration developments.
