Amtrak allegedly breached by ShinyHunters, massive data leak threatened

Hacking group ShinyHunters has listed the National Railroad Passenger Corporation on its data leak site, claiming to have stolen 9.4 million records containing personally identifiable information and corporate data, Cybernews reports.

The hackers reportedly obtained unauthorized access via Salesforce. The gang has previously targeted Salesforce employees via social engineering attacks. The attack allowed ShinyHunters to obtain the access details of different companies using the Salesforce platform. While samples of the stolen data have not been released, ShinyHunters threatened to expose the pilfered information on Apr. 14 if the ransom is not paid.

"When PII is involved, there's always a chance of social engineering attacks. The impact depends whether the data in question belongs to the company employees or customers. In Amtrak's case it could be either, since Amtrak sells train tickets," according to Cybernews researchers. ShinyHunters has claimed the attacks on Mercer Advisors, Beacon Pointe Advisors, Cisco Systems, Hallmark, and Rockstar Games.