Google has confirmed that attackers created a fraudulent account within its Law Enforcement Request System (LERS), a sensitive platform used worldwide by law enforcement and intelligence agencies to submit subpoenas, court orders, and emergency data requests.
🔍 Google’s Statement:
- The account was identified and disabled quickly
- No requests were submitted using the account
- No user data was accessed
📌 Threat Actor Involvement
The group “Scattered Lapsus$ Hunters”, which claims links to ShinyHunters, Lapsus$, and Scattered Spider, took credit on Telegram.
- Posted alleged screenshots of access to Google LERS and the FBI’s eCheck system
- Has been behind Salesforce & Salesloft-related data theft attacks earlier this year
- Previously leveraged social engineering and stolen OAuth tokens for large-scale corporate breaches
🌍 Potential Impact
If exploited, such access could allow adversaries to:
- Impersonate law enforcement
- Request disclosure of highly sensitive user data
- Undermine global trust in critical government–tech company cooperation
📢 Ongoing Threat
While the group claimed it was “going dark,” researchers believe it will continue operations quietly, given its extortion track record and global targeting.
⚠️ Takeaway
This incident highlights the potential risks to privacy and security that fraudulent access to sensitive platforms, even without data loss, poses worldwide.
At Alcaeus Services, we help enterprises and government partners mitigate insider threats, secure authentication systems, and prepare defenses against social engineering campaigns.
