KFC (Partial) Breach

The incident is one of several breaches affecting Salesforce in 2025. A group calling itself "Scattered LAPSUS$ Hunters" released a limited sample of the stolen database on October 3, 2025. The records have since been indexed and anonymized in our search engine.

According to the attackers, the full dataset is scheduled for release on October 10, 2025.

Data found in hackers’ sample -

🧍 Personal Information (Contact)

• Full name - ✅ Present
• Birthdate / age - ⛔ Empty
• Gender - ⛔ Empty
• Title / salutation - ⛔ Empty

📧 Contact Information

• Email (store inbox) - ✅ Present
• Email (individual contact) - ✅ Present
• Phone (store) - ✅ Present
• Phone (individual contact) - ✅ Present
• Mailing address (individual contact) - ✅ Present
• Mailing address (store location) - ✅ Present (street, city, state, ZIP)

🏪 Store / Franchise Account (Account record)

• Store identifier / account “Name” - ✅ Present
• Account type (FRN) - ✅ Present
• Store address (Address_1__c, City__c, State__c, Zip_Code__c) - ✅ Present
• Status code - ✅ Present
• Open date - ✅ Present
• Status date - ✅ Present
• Previous store ID - ✅ Present

🗺️ Territory / DMA & Ownership

• DMA ID & description - ✅ Present
• Territory code & description - ✅ Present
• Territory manager (first/last name & email) - ✅ Present
• Owner (first/last name & address) - ✅ Present

👔 Org / Role Details

• Account “Type” = FRN (franchise) - ✅ Present
• Internal owner/assignee (OwnerId) - ✅ Present
• Additional internal codes (ftc_code/firstname/lastname/email) - ✅ Present

📨 Customer Service Flags (Contact)

• “Chronic Caller” flag - ✅ Present (value recorded)
• “Not Eligible for Fulfillment” flag - ✅ Present (value recorded)
• “Not Eligible for Refund” flag - ✅ Present (value recorded)
• Case count - ✅ Present
• Email bounced - ✅ Present (false in sample)

⚙️ System Metadata (both records)

• Record IDs - ✅ Present
• Created date / created by - ✅ Present
• Last modified date / modified by - ✅ Present
• SystemModstamp - ✅ Present
• IsDeleted - ✅ Present (false)
• Photo URL - ✅ Present
• LastActivityDate (contact) - ✅ Present