Extortion

Security incidents tagged Extortion. Newest first.

0 Extortion incidents in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore

Show 6 older incidents

Oct 3HighDiscord support vendor breach exposes ~70,000 government ID photosNo fix needed
Discord customer support (third-party vendor / ticketing) No fix needed
An attacker got into a third-party customer-service system Discord used, exposing data of users who had contacted Support or Trust & Safety. About 70,000 users may have had government ID photos (from age-verification appeals) accessed. Discord named the vendor as 5CA, which denied its systems were hacked.
Open incident →
Oct 1HighRed Hat Consulting GitLab breached: ~800 customer engagement reports stolenNo fix needed
Red Hat Consulting self-managed GitLab No fix needed
The Crimson Collective broke into a self-managed GitLab instance used by Red Hat Consulting and claimed about 570 GB from 28,000 repos, including roughly 800 Customer Engagement Reports with infrastructure, config and credential details. Red Hat confirmed the access and said its products, supply chain and hosted services were not affected. ShinyHunters later joined the extortion.
Open incident →

CriticalPatched
Cl0p extortion campaign via Oracle E-Business Suite zero-day (CVE-2025-61882)
Cl0p-branded extortion emails reached executives from September 29, 2025, claiming theft of Oracle E-Business Suite data. Mandiant tied the campaign to exploitation of an unauthenticated RCE in EBS (SyncServlet), patched as CVE-2025-61882 for EBS 12.2.3 to 12.2.14. A separate July UiServlet SSRF campaign was later tracked as CVE-2025-61884.
Oracle E-Business SuiteClosed Oct 20, 2025updated Oct 20, 2025

Jun 4HighVishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)No fix needed
Salesforce customer instances (social engineering, not a Salesforce vulnerability) No fix needed
UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).
Open incident →

May 11HighCoinbase: bribed support contractors leak data of 69,461 customers, $20M ransom refusedNo fix needed
Coinbase customer support systems No fix needed
Criminals bribed overseas support staff to pull customer data (names, contact details, partial financial data, ID images, balances and transactions), then demanded $20M. Coinbase refused, offered a matching bounty, and estimated $180M to $400M in costs. No passwords, private keys or funds were accessed directly.
Open incident →

CriticalNo fix needed
Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)
A financially motivated group Mandiant tracks as UNC5537 logged into Snowflake customer accounts using credentials stolen by infostealer malware, some dating back to 2020, on accounts without MFA or network allow lists. It then stole data and extorted the victims. Mandiant and Snowflake notified about 165 potentially exposed organizations. Victims included Ticketmaster/Live Nation and AT&T, which said call and text records of nearly all its cellular customers were taken. Mandiant found no breach of Snowflake's own enterprise environment.
Snowflake customer instancesClosed Jul 12, 2024updated Jul 12, 2024