Google confirmed it suffered a data breach in June after hackers from the ShinyHunters group exploited a vulnerability in its Salesforce CRM system. The attack is part of a larger wave of intrusions affecting multiple high-profile companies, with customer data stolen and ransom demands issued.
According to a disclosure reported by BleepingComputer, Google’s corporate Salesforce instance was accessed by cybercriminals, who extracted limited customer data before being cut off. The stolen data included basic business information like company names and contact details. Google has categorized the threat actors as UNC6040 or UNC6240, though cybersecurity investigators confirm ShinyHunters was responsible.
ShinyHunters has claimed responsibility for numerous Salesforce breaches in recent weeks, targeting global corporations including Adidas, Cisco, Qantas, Allianz Life, and luxury fashion giants under LVMH like Dior, Louis Vuitton, and Tiffany & Co. One unnamed company reportedly paid four Bitcoins—worth roughly $400,000—to prevent their stolen data from being leaked.
The hacking group uses a voice phishing method known as “vishing” to manipulate employees into granting unauthorized access to company systems. Once inside, attackers download customer records and initiate extortion attempts, threatening to release sensitive data unless ransom demands are met.
The breach is only the latest in ShinyHunters’ history of high-profile cyberattacks, with past victims including PowerSchool, Oracle Cloud, AT&T, and Wattpad. The group is notorious for leaking corporate data and selling access credentials on dark web forums.
ShinyHunters has hinted that a trillion-dollar company has also been compromised, leaving open speculation as to whether the claim refers to Google or another tech giant. The ongoing nature of these attacks raises alarms about the vulnerability of widely used platforms like Salesforce and the risks posed by increasingly sophisticated extortion tactics.
