In an unusual escalation, a hacker group calling itself Scattered LapSus Hunters has demanded Google terminate two of its leading cybersecurity professionals, Austin Larsen and Charles Carmakal. Both have been central in exposing criminal networks, including investigations into the Salesforce data breach that recently fueled phishing attacks targeting Gmail’s 2.5 billion users.

The hackers claim to unite members from groups like Scattered Spider, LapSus, and ShinyHunters, but experts say they’ve shown no evidence of breaching Google’s core systems. Instead, they appear to be leveraging the Salesforce breach, where attackers stole business contact information using compromised OAuth tokens. This has triggered a wave of sophisticated phishing campaigns, with Google warning that 37% of account hijack attempts now stem from such scams.

Analysts see the hackers’ demand as a shift from stealing data to trying to influence corporate decisions, a concerning precedent in cybersecurity. Google has since cut Salesloft integrations and urged users to adopt two-factor authentication.

Whether this is a genuine threat or a publicity stunt, it highlights how cybercriminals are becoming bolder, aiming not just at data but at corporate governance itself.