What Happened

In August 2025, Google disclosed that one of its corporate Salesforce instances had been compromised as part of the same broad campaign that hit numerous other large enterprises during the summer. According to Google's own Threat Intelligence Group (GTIG), the intrusion itself took place in June 2025, when the financially motivated threat group tracked as ShinyHunters — also identified by researchers under the cluster name UNC6040 — used a voice-phishing, or vishing, call to a Google employee. The caller impersonated internal IT support and convinced the target to authorize what appeared to be a legitimate connection to Salesforce, but was in fact a maliciously modified version of Salesforce's own Data Loader application, a tool normally used for bulk importing and exporting records.

Once that connection was authorized, the attackers used it to query and extract data from the Salesforce instance used to store contact and business information for small and medium-sized business customers — the kind of database sales and support teams use to track prospective and existing accounts, rather than a system holding consumer account credentials.

Scope of the Breach

Google said it identified and shut down the unauthorized access within a matter of hours of detecting it, limiting how long the attackers had a live connection into the environment. Security researchers who reviewed the broader campaign estimated that roughly 2.55 million records were affected in Google's instance specifically, though Google emphasized that the exposed information was largely limited to business contact details rather than sensitive personal or financial data.

The categories of information involved were described as:

• Business names
• Publicly available or business-context contact details, such as names, email addresses, and phone numbers associated with business accounts

Google stated explicitly that no passwords, financial account information, or other highly sensitive personal data were stored in the affected system, and that core Google account security — including Gmail and Google Cloud credentials — was not implicated in the incident.

Attack Details

The intrusion fits a pattern GTIG itself had been tracking and publicly warning about throughout 2025: UNC6040/ShinyHunters operators cold-call employees at target organizations, often posing as internal IT help-desk staff, and walk them through steps that end with the employee approving a connected application inside Salesforce. Because the connection is authorized by a legitimate, logged-in employee, the resulting data access can initially look like normal business activity rather than an intrusion, which has made this technique effective against a wide range of large, security-mature organizations during 2025 — not just smaller companies with fewer resources.

Google's swift detection and containment were notable relative to other victims in the same campaign, several of which had attackers active in their environments for longer periods before discovery. GTIG's research team, which tracks the group extensively, has said the campaign's operators frequently follow data theft with extortion attempts weeks or months later, sometimes under the ShinyHunters name and sometimes using a separate extortion-branded identity, pressuring victims with threats to leak or sell the stolen data unless a ransom is paid.

Google publicly named itself among the confirmed victims of the campaign alongside other major organizations targeted in the same wave, including Adidas, Qantas Airways, Allianz Life, and Cisco — all breached through variations of the same vishing-into-Salesforce technique during roughly the same window in mid-2025.

Google's disclosure was notable in part because the company chose to reveal the incident through its own threat intelligence arm rather than waiting for the information to surface through leaked data or third-party reporting. GTIG researchers had already been publishing detailed technical write-ups on UNC6040's tactics before Google confirmed it was itself a victim, giving the disclosure an unusual degree of technical transparency compared with many other companies hit in the same campaign, several of which offered only brief, high-level statements about what had happened.

In the weeks after the campaign became public, an extortion-focused persona associated with ShinyHunters and the broader Scattered Lapsus$ Hunters collective began contacting multiple victim organizations, including reports of attempts to pressure companies by threatening to publish stolen Salesforce data unless payment was made. Google did not disclose whether it personally received an extortion demand tied to its own breach, but it used its public research to warn other Salesforce customers that extortion attempts following this style of vishing intrusion were common across the broader campaign.

Remediation and Response

Google's response emphasized rapid detection and transparency. The company said it completed notifications to all customers whose business contact information appeared in the exposed dataset by early August 2025, and it published technical detail about the attack chain through its Threat Intelligence Group's public research, both to inform affected customers and to help other organizations recognize similar vishing attempts targeting their own Salesforce environments.

Because Google was simultaneously a victim and one of the security industry's most prominent research voices on the broader ShinyHunters/UNC6040 campaign, its public guidance for other organizations carried particular weight. Recommended defensive steps included:

• Restricting which employees have the ability to authorize new connected applications or OAuth grants within Salesforce and other SaaS platforms
• Requiring out-of-band verification — such as callbacks through a known internal number — before honoring any phone request that asks an employee to approve system access
• Enabling IP allow-listing and session-based restrictions on Salesforce connected apps where feasible
• Actively monitoring for the creation of new connected apps and unusual bulk data-export activity, which are common indicators of this attack pattern

The Google incident became one of the most closely scrutinized cases in the 2025 Salesforce breach wave precisely because of the company's own visibility into threat intelligence — its dual role as victim and investigator gave the security community an unusually detailed public account of how the ShinyHunters campaign operated across dozens of other organizations that were less forthcoming about technical specifics.