ShinyHunters Leak Alleged Knowledge from Qantas, Vietnam Airways and Different Main Companies

The hackers, figuring out themselves as “Scattered Lapsus$ Hunters,” a collective stated to mix components of Scattered Spider, Lapsus$, and ShinyHunters, have now revealed information allegedly belonging to six of the 39 focused firms.

The businesses named within the leak are as follows:

1. Fujifilm
2. GAP, INC.
3. Vietnam Airways
4. Engie Assets
5. Qantas Airways Restricted
6. Albertsons Firms, Inc.

What’s In The Knowledge

Whereas the impacted firms are the one ones who can confirm the breach, Hackread.com has carried out an in-depth evaluation of the leaked information, and it seems to be respectable. In all 6 leaks, the document accommodates private particulars of shoppers, enterprise, together with electronic mail addresses, full names, addresses, passport numbers, cellphone numbers,

Qantas Airways Restricted

The dataset leaked from Qantas Airways Restricted is substantial in measurement, weighing in at 153 GB. The recordsdata are in JSON format and include over 5 million data. The info was revealed on October 10, 2025, and marked as public by the risk actors.

This dataset combines personally identifiable info (PII) with buyer loyalty and inside enterprise information, making it a critical publicity if genuine. Right here’s what the leaked information accommodates:

1. Gender
2. Nation
3. Full identify
4. Date of delivery
5. Factors steadiness
6. Foreign money used (AUD)
7. Frequent flyer quantity
8. Frequent flyer be a part of and anniversary dates
9. Title or salutation (for instance, Mrs, Mr)
10. Frequent flyer tier and standing credit
11. Cellphone numbers (most important, alternate, house, enterprise, cellular)
12. E-mail addresses (main, alternate, enterprise, house)
13. Account creation and modification timestamps
14. Mailing tackle particulars (metropolis, postal code, latitude, longitude, and so forth.)
15. Account or buyer ID numbers (inside Salesforce and Qantas IDs)
16. Profile preferences (for instance, meal, seat, advertising and marketing preferences, newsletters)
17. Membership and loyalty particulars (bronze tier, expiry, standing credit until subsequent degree)
18. Inner CRM fields (OwnerId, RecordTypeId, CreatedBy, and so forth.)
19. Hyperlinks to inside experiences and templates (for instance, “QCC Frequent Flyer Report”, “QCC Lounges Report”)
20. Buyer notes and remarks fields
21. Geolocation information (latitude and longitude of mailing tackle)
22. Exercise and make contact with monitoring metadata (final modified, final seen, and so forth.)
23. Inner flags and standing indicators (HasOptedOutOfEmail, DoNotCall, Lively, Sensitive_Contact, and so forth.)

In its safety advisory revealed on 12 October 2025, the corporate confirmed that information from 5.7 million of its prospects was revealed on-line following a serious cyberattack. It’s price noting that in July 2025, the corporate had additionally confirmed a serious information breach linked to a third-party vendor, however didn’t disclose its identify on the time.

Vietnam Airways

Vietnam Airways’ dataset is 63.62 GB, additionally in JSON format, with greater than 23 million data. Just like the others, it was made public on October 10, 2025. The discharge, if genuine, represents one of many bigger leaks attributed to this spherical of breaches.

These document contains each personally identifiable info (PII) and company account information, together with inside airline CRM fields and loyalty program identifiers such because the frequent flyer quantity. Here’s a record of the sorts of information contained within the Vietnam Airways document:

1. Age
2. Gender
3. Full identify
4. Cellphone quantity
5. Foreign money used
6. E-mail tackle
7. Frequent flyer quantity
8. Date of delivery and 12 months of delivery
9. Proprietor and system metadata
10. Inner account and make contact with IDs
11. Enterprise or cargo-related fields
12. Account sort and document classification
13. Company or enterprise function info
14. Company and tax info fields
15. Firm-related electronic mail and cellphone fields
16. Final journey and travel-related monitoring fields
17. Nation and metropolis fields (although some are clean)
18. Residential tackle (road and partial location particulars)

Albertsons Firms, Inc.

The leak related to Albertsons Firms, Inc. is comparatively smaller, totalling 2 GB of JSON recordsdata. In line with the itemizing, it accommodates over 672,000 data. The info was revealed on October 10, 2025, and labelled as public.

GAP, INC.

The dataset tied to GAP, INC. is 1 GB in measurement, formatted in JSON, and reportedly holds greater than 224,000 data. The knowledge was uploaded on October 10, 2025, with a public standing tag, suggesting it’s accessible to anybody by way of the leak portal.

Fujifilm

The Fujifilm information leak seems smaller as compared, listed at 155 MB and in CSV format. Regardless of its smaller measurement, the dataset nonetheless allegedly contains round 224,000 data. It too was made public on October 10, 2025.

Engie Assets

The dataset from Engie Assets measures 3 GB and is formatted as JSON recordsdata. It’s stated to incorporate greater than 537,000 data, revealed publicly on October 10, 2025.

Whole Variety of Firms Impacted within the Breach

The total record of 39 firms recognized as victims within the alleged Salesforce information breach:

1. KFC – 1.3GB
2. ASICS – 9GB
3. UPS – 91.34GB
4. IKEA – 13GB
5. GAP, INC. – 1GB
6. Petco – 9.9GB
7. Cisco – 5.6GB
8. McDonald’s – 28GB
9. Cartier – 1.4GB
10. Adidas – 37GB
11. Fujifilm – 155MB
12. Instacart – 32GB
13. Marriott – 7GB
14. Walgreens – 11GB
15. Pandoranet – 8.3GB
16. Chanel – 2GB
17. CarMax – 1.7GB
18. Disney/Hulu – 36GB
19. TransUnion – 22GB
20. Aeroméxico – 172.95GB
21. Toyota Motor Company – 64GB
22. Stellantis – 59GB
23. Republic Companies – 42GB
24. TripleA (aaacom) – 23GB
25. Saks Fifth – 1.1GB
26. Albertsons (Jewel Osco, and so forth) – 2GB
27. Engie Assets (Plymouth) – 3GB
28. 1-800Accountant – 18GB
29. HMH (hmhcocom) – 88GB
30. Instructurecom – Canvas – 35GB
31. Google Adsense – 19GB
32. HBO Max – 3.2GB
33. FedEx – 1.1TB
34. Qantas Airways – 153GB
35. Vietnam Airways – 63.62GB
36. Air France & KLM – 51GB
37. Residence Depot – 19.43GB
38. Kering (Gucci, Balenciaga, Brioni, AlexMcQ) – 10GB

What’s Subsequent?

Whereas extra information was initially anticipated, the hackers introduced on Telegram that they won’t be releasing any extra info, stating, “Lots of people are asking what else can be leaked. Nothing else can be leaked. The whole lot that was leaked was leaked, we’ve nothing else to leak, and clearly, the issues we’ve can’t be leaked for apparent causes.” This assertion leaves the way forward for the remaining information unsure.

Nevertheless, what has already been leaked is damaging sufficient. If verified, the discharge of those databases might have critical penalties throughout a number of industries. Airways, retailers, and power firms retailer giant volumes of delicate buyer and enterprise info, together with private particulars, contact information, and inside data.

The publicity of such information places affected people liable to identification theft and fraud, whereas additionally creating potential reputational and monetary harm for the businesses concerned. Since these leaks are linked to earlier claims a couple of Salesforce vulnerability, the incident additionally raises questions in regards to the safety practices of third-party platforms that handle and retailer such intensive information.