CrowdStrike denies breach after insider sent internal screenshots to hackers
Pierluigi Paganini
November 21, 2025
CrowdStrike says an insider shared internal screenshots with hackers but confirms no system breach and no customer data exposure.
BleepingComputer first reported that CrowdStrike said an insider shared internal system screenshots with hackers, after Scattered Lapsus$ Hunters leaked them on Telegram. The company stresses that no systems were breached and no customer data was exposed.
“We identified and terminated a suspicious insider last month following an internal investigation that determined he shared pictures of his computer screen externally,” a CrowdStrike spokesperson told BleepingComputer. “Our systems were never compromised and customers remained protected throughout. We have turned the case over to relevant law enforcement agencies.”
CrowdStrike did not name the hacker group behind the leak of internal system screenshots.
ShinyHunters told BleepingComputer they offered a CrowdStrike insider $25,000 for access to the company’s network. They claim they received SSO authentication cookies, but CrowdStrike had already detected the insider and cut off his access. The group also tried to buy internal reports about ShinyHunters and Scattered Spider, but never obtained them.
Recently, ShinyHunters launched a new data-theft wave hitting hundreds of companies’ Salesforce instances. In Telegram posts, the group listed major firms like Atlassian, F5, GitLab, LinkedIn, and Verizon. The attackers claim they gained access to these Salesforce environments by breaching Gainsight and using secrets previously stolen in the Salesloft Drift compromise.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
Pierluigi Paganini
(SecurityAffairs – hacking, insider)