Vietnam Airlines Exposes 7.3 M Customer Records After Salesforce Breach
What Happened — In June 2025 a hacking group identifying itself as “Scattered LAPSUS$ Hunters” gained unauthorized access to Vietnam Airlines’ Salesforce environment. The intrusion led to the public release of 7,316,915 unique customer records, including email addresses, names, phone numbers, dates of birth and loyalty‑program membership numbers.
Why It Matters for Trust & Control Assurance
- Demonstrates the risk of insufficient continuous monitoring of third‑party SaaS platforms – a core control area for any assurance program.
- Highlights the need for documented vendor‑risk assessments and contractual security obligations that can be presented as audit evidence.
- Shows that a defensible incident‑response trail (log collection, breach notification, remediation steps) is essential for regulatory and stakeholder confidence.
Who Is Affected – Travel & logistics providers, airline customers, and any organization that relies on Salesforce or similar cloud‑hosted CRM services for storing personally identifiable information.
Recommended Actions
- Map this incident to your vendor‑oversight control objective (e.g., “Assess and monitor third‑party security posture”).
- Gather evidence of recent SaaS security assessments, contracts, and monitoring logs to demonstrate due diligence.
- Implement continuous SaaS‑environment monitoring and enforce MFA for all privileged accounts.
Source: Have I Been Pwned – Vietnam Airlines breach
Technical Notes – The breach stemmed from a compromise of the Salesforce instance used by Vietnam Airlines; no specific CVE was disclosed. Exposed data types: email, name, phone, date of birth, loyalty‑program ID.
Source: https://haveibeenpwned.com/api/v3/breach/VietnamAirlines