Loading story…
U.K. police arrested seven people aged 16 to 21 over suspected links to Lapsus$, the extortion-focused hacking group tied to intrusions at Microsoft, Nvidia, Samsung, Ubisoft, Okta, and other major firms. Reporting identified a 16-year-old near Oxford as a suspected central figure, while investigators and journalists described the group as a loose set of mostly young operators who stole data, leaked source code and internal documents, and taunted victims publicly on Telegram and other platforms. Microsoft confirmed the group obtained source code through limited access, reinforcing the scale and credibility of the campaign.
The activity continued to expand as Globant disclosed unauthorized access to a limited portion of its code repository after Lapsus$ leaked 70GB of allegedly stolen data. The company said the exposed material appeared limited to certain source code and project documentation for a small number of clients, and that it had not found evidence of broader compromise. Coverage of the group highlighted that its operators often relied on comparatively simple but highly effective tactics—including social engineering, SIM swapping, MFA fatigue attacks, and attempts to bribe insiders—showing how basic intrusion methods enabled a string of high-profile breaches and data leaks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
A UK court ordered the teenager linked to Lapsus$ and the GTA 6 hack to be detained indefinitely in a secure hospital after sentencing. The ruling marked a major legal outcome in the case following the group's earlier arrests and charges.
Brazil's Federal Police announced the arrest in Feira de Santana, Bahia, of the main Brazilian suspect believed to be part of the Lapsus$ group. Authorities said the action followed Operation Dark Cloud, which investigates cyberattacks against Brazil's Ministry of Health and other federal entities linked to late-2021 intrusions.
UK authorities charged two teenagers in connection with hacking activity linked to the Lapsus$ group. The charges marked an escalation from the earlier arrests of seven suspects who had initially been released under investigation.
Globant confirmed that a limited section of its source code repository had been accessed without authorization and said the exposed material appeared restricted to certain source code and project documentation for a very small number of clients. The company said it activated security protocols and began an investigation, with no evidence at that time of broader compromise.
Lapsus$ published roughly 70GB of data it said was stolen from IT services firm Globant, extending the group's run of public data leaks against major corporate targets.
City of London Police arrested seven people aged 16 to 21 in connection with an investigation into the Lapsus$ hacking group. Authorities said all were later released under investigation while inquiries continued.
Investigators and cyber researchers reported that a 16-year-old living near Oxford, England, was suspected to be a central figure in Lapsus$, alongside other possible members including a teenager in Brazil.
Microsoft said the group it tracks as DEV-0537, publicly associated with Lapsus$, obtained limited access to one account and stole portions of source code repositories. The company said no customer code or data was involved and published details on the group's tactics, including social engineering and MFA fatigue attacks.
Okta disclosed that attackers had gained access to a laptop belonging to a third-party customer support engineer, an incident widely tied to Lapsus$ activity and later used by the group to publicize screenshots and claims.
Lapsus$ claimed it had breached Ubisoft, adding the game publisher to a growing list of prominent organizations targeted by the group.
Samsung was identified as another major victim of Lapsus$, with the group stealing and publishing source code and internal materials as part of its ongoing campaign against technology firms.
Lapsus$ was linked to an intrusion at Nvidia in which the group stole and leaked internal company data, helping establish the group's profile through high-impact extortion and data-theft activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
13 references tracked. Mallory keeps watching after this page renders.
bbc.co.uk
Open sourceapp.tidalcyber.com
Open sourcebbc.com
Open sourcearstechnica.com
Open sourcebleepingcomputer.com
Open sourcetheverge.com
Open sourcetheverge.com
Open sourcegov.br
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Nvidia said a cyberattack exposed employee credentials and proprietary data after the extortion group **Lapsus$** claimed it had breached the company’s corporate network and stolen more than **1TB** of information. Reports said the stolen material included schematics, firmware and driver source code, and a leak of usernames and cryptographic password hashes for **71,335 employees**. The group also issued an unusual extortion demand, threatening further leaks unless Nvidia removed its **Lite Hash Rate (LHR)** restrictions from GeForce RTX 30-series graphics cards. The fallout expanded beyond the initial intrusion as attackers began using **stolen Nvidia code-signing certificates** to sign malware and malicious Windows drivers, including tools such as **Cobalt Strike**, **Mimikatz**, backdoors, RATs, and a Quasar sample. Researchers warned that even expired certificates could still allow signed drivers to load in Windows, complicating defenses and raising the risk of broader downstream abuse. The incident unfolded amid wider concern over high-profile intrusions linked to Lapsus$, including a separate breach that prompted **Ubisoft** to order a company-wide password reset.
Jun 29, 2026
The Scattered Lapsus$ Hunters (SLSH), a cybercrime collective formed from members of Scattered Spider, Lapsus$, and ShinyHunters, announced a temporary retreat from online activity after the FBI seized their clearweb site. The group, known for its Western and English-speaking membership, issued a series of aggressive messages on Telegram, vowing to retaliate against the FBI and promising a return in 2026. This announcement followed a period of heightened law enforcement scrutiny, including the arrest and charging of two teenagers in the UK for their alleged involvement in attacks attributed to Scattered Spider, a component of SLSH. The group has a history of dramatic exits and returns, having previously declared a hiatus only to reappear days later. SLSH has gained notoriety for targeting large organizations and for the scale of its operations. In parallel with their public threats, the group claimed responsibility for a massive data breach affecting 39 major companies worldwide, exploiting a Salesforce vulnerability to steal 989 million records. They demanded negotiations with Salesforce and the affected firms, threatening to release the data if ignored. When their demands were unmet, SLSH published data allegedly belonging to six companies, including Qantas Airways, Vietnam Airlines, Fujifilm, GAP Inc., Engie Resources, and Albertsons Companies. The leaked datasets reportedly contain extensive personally identifiable information (PII), such as full names, addresses, passport numbers, phone numbers, email addresses, and, in the case of Qantas, detailed frequent flyer information and internal business data. The Qantas dataset alone is said to be 153 GB and includes over 5 million records. The authenticity of the data has been partially verified by independent analysis, though only the affected companies can fully confirm the breach. The exposure of such sensitive information poses significant risks for identity theft, fraud, and targeted attacks against both individuals and organizations. The SLSH collective's actions have prompted calls for increased vigilance and improved cybersecurity measures among large enterprises, especially those using cloud-based platforms like Salesforce. Law enforcement agencies continue to investigate and pursue members of the group, while the cybersecurity community monitors for further developments and potential retaliatory actions promised by SLSH upon their return.
Jun 29, 2026
A new cybercrime supergroup known as Scattered LAPSUS$ Hunters has emerged in 2025, combining the capabilities and tactics of three notorious threat actors: Scattered Spider, LAPSUS$, and ShinyHunters. This alliance marks a significant escalation in the threat landscape, as the group leverages a blend of social engineering, technical attacks, and public extortion to target high-value enterprise environments. The group is known for its multi-phase assaults, which often begin with sophisticated social engineering techniques such as phone-based vishing to gain initial access, particularly by targeting help desks and exploiting human vulnerabilities. Once inside, the attackers employ insider recruitment, source code theft, and large-scale data exfiltration, drawing on the distinct strengths of each constituent group. Scattered LAPSUS$ Hunters have focused their attacks on major SaaS platforms, including Salesforce, as well as enterprise applications from Oracle and SAP. Their victim list includes prominent organizations across retail, aviation, insurance, and automotive sectors, with named targets such as Home Depot, Marriott, the National Bank of Canada, and Tata Motors' Jaguar Land Rover. The group’s operations are characterized by unpredictability and a willingness to disrupt major businesses, often causing significant operational and reputational damage. Unlike traditional ransomware groups, Scattered LAPSUS$ Hunters do not limit themselves to endpoint infections and ransom demands; they also engage in ransoming stolen data and public extortion campaigns. The group’s members, reportedly including Western teenagers with substantial cryptocurrency holdings, operate with little regard for the consequences of their actions, further complicating law enforcement efforts. Their tactics reflect a shift from the previously dominant Russian ransomware model to a more chaotic, opportunistic approach. The group’s emergence from the cybercrime community known as The Com highlights the evolving nature of cybercriminal alliances and the increasing sophistication of their playbooks. Security experts have noted that the group’s attacks are not only technically advanced but also highly adaptive, making them particularly challenging to defend against. Organizations are advised to strengthen their social engineering defenses, monitor for insider threats, and enhance detection capabilities for unusual access patterns. The rise of Scattered LAPSUS$ Hunters underscores the need for a holistic security posture that addresses both technical and human vulnerabilities. Their activities in 2025 have set a new benchmark for the scale and impact of cybercrime supergroups, prompting urgent calls for improved cross-sector collaboration and intelligence sharing.
Jun 29, 2026