Google Confirms Salesforce CRM Breach

Google Threat Intelligence Group (GTIG) has confirmed a data breach in its Salesforce CRM database, linked to the hacking group ShinyHunters.

The attackers, also known as UNC6040, gained access to Google’s Salesforce CRM in June, likely through a social engineering attack.

After discovering the breach, Google responded by conducting an impact analysis and initiating mitigations. In a blog post, the company explained, “Analysis revealed that data was retrieved by the threat actor during a small window of time before the access was cut off.”

GTIG states that the group is known for large-scale data theft of Salesforce environments using voice phishing, posing as IT support. The method typically involves calling employees, especially in English-speaking offices of global companies, and convincing them to hand over credentials or approve a fraudulent Salesforce Data Loader application, which enables them to access sensitive information.

Then the group uses the stolen data to extort victims for financial gain, often months after the incidents occurred and sometimes in collaboration with other threat actors. Despite taking the necessary actions to prevent similar incidents in the future, GTIG warns that ShinyHunters may launch a data leak site (DLS) to monetize the stolen records, including those compromised in the Google Ads breach.

According to Cyber Security News, ShinyHunters already tried to extort Google, requesting 20 Bitcoins (approximately $2.3 million) from the company. Later, the group claimed the demand was made “for the lulz” and wasn’t a serious attempt at extortion.

The breached database system stored data of prospective Google Ads customers. According to GTIG, the compromised data included “largely publicly available business information” of small and medium-sized companies, including business names, contact details (e.g., email addresses, phone numbers), and related notes.

ShinyHunters hackers told Cyber Security News that they stole around 2.5 million records, information that Google has neither confirmed nor denied. The company has already notified the impacted individuals.

While Google’s recent data breach involved mostly public data and no serious consequences have been reported, the incident shows that no organization, large or small, is immune to cybercrime. Last year, Russian government hackers were found spying on Microsoft executives.

As security experts warn, “If it can happen to one of the wealthiest and best-defended companies in the world, it can happen to anyone.”

With human error often playing a role in data breaches, experts advise taking a layered approach to security that combines advanced security awareness training with strict access controls.