Google has confirmed that hackers created a fraudulent account in its Regulation Enforcement Request System (LERS) platform that legislation enforcement makes use of to submit official knowledge requests to the corporate
“We now have recognized {that a} fraudulent account was created in our system for legislation enforcement requests and have disabled the account,” Google advised BleepingComputer.
“No requests have been made with this fraudulent account, and no knowledge was accessed.”
The FBI declined to touch upon the menace actor’s claims.
This assertion comes after a gaggle of menace actors calling itself “Scattered Lapsus$ Hunters” claimed on Telegram to have gained entry to each Google’s LERS portal and the FBI’s eCheck background verify system.
The group posted screenshots of their alleged entry shortly after saying on Thursday that they have been “going darkish.”
The hackers’ claims raised considerations as each LERS and the FBI’s eCheck system are utilized by police and intelligence companies worldwide to submit subpoenas, court docket orders, and emergency disclosure requests.
Unauthorized entry might enable attackers to impersonate legislation enforcement and achieve entry to delicate consumer knowledge that ought to usually be protected.
The “Scattered Lapsus$ Hunters” group, which claims to encompass members linked to the Shiny Hunters, Scattered Spider, and Lapsus$ extortion teams, is behind widespread knowledge theft assaults concentrating on Salesforce knowledge this 12 months.
The menace actors initially utilized social engineering scams to trick staff into connecting Salesforce’s Knowledge Loader device to company Salesforce cases, which was then used to steal knowledge and extort firms.
The menace actors later breached Salesloft’s GitHub repository and used Trufflehog to scan for secrets and techniques uncovered within the personal supply code. This allowed them to seek out authentication tokens for Salesloft Drift, which have been used to conduct additional Salesforce knowledge theft assaults.
These assaults have impacted many firms, together with Google, Adidas, Qantas, Allianz Life, Cisco, Kering, Louis Vuitton, Dior, Tiffany & Co, Cloudflare, Zscaler, Elastic, Proofpoint, JFrog, Rubrik, Palo Alto Networks, and many extra.
Google Menace Intelligence (Mandiant) has been a thorn within the facet of those menace actors, being the first to reveal the Salesforce and Salesloft assaults and warning firms to shore up their defenses.
Since then, the menace actors have been taunting the FBI, Google, Mandiant, and safety researchers in posts to numerous Telegram channels.
Late Thursday night time, the group posted a prolonged message to a BreachForums-linked area inflicting some to imagine the menace actors have been retiring.
“That is why now we have determined that silence will now be our energy,” wrote the menace actors.
“You may even see our names in new databreach disclosure stories from the tens of different multi billion greenback firms which have but to reveal a breach, in addition to some governmental companies, together with extremely secured ones, that doesn’t imply we’re nonetheless energetic.”
Nonetheless, cybersecurity researchers who spoke with BleepingComputer imagine the group will proceed conducting assaults quietly regardless of their claims of going darkish.
Replace 9/15/25: Article title up to date as some felt it indicated a breach.
46% of environments had passwords cracked, practically doubling from 25% final 12 months.
Get the Picus Blue Report 2025 now for a complete have a look at extra findings on prevention, detection, and knowledge exfiltration traits.
