Scattered Lapsus$ Hunters

Scattered Lapsus$ Hunters, sometimes referred to as UNC6040 and UNC6395, is a cybercrime supergroup also known and referred to as "Trinity of Chaos". The supergroup is an international extortion-focused collective or alliance. They first appeared in or around August 2025, and have claimed responsibility for several notable data breaches, including but not limited to; stealing over 1 billion customer records from Salesforce from both their UNC6040 and UNC6395 campaigns, RedHat and doxxing ICE officials. Their website BreachForums was seized by the US and French police forces in following the public extortions against Salesforce. The supergroup claimed on their Telegram channel to be formed from members of other groups like Scattered Spider, Lapsus$ and ShinyHunters.