8th August 2025 Cyber Update: Google Falls Victim to ShinyHunters Salesforce Breach

Update: Google disclosed on August 5 2025, that hackers from the ShinyHunters group, formally designated as UNC6040, successfully breached one of its corporate Salesforce database instances in June 2025. The attack targeted a system used to store contact information and related notes for small and medium-sized businesses. According to Google's Threat Intelligence Group, the attackers used voice phishing techniques to trick company employees into granting access to the cloud-based Salesforce database.

The breach occurred during what Google described as "a small window of time before the access was cut off." The compromised data was confined to basic business information including business names and contact details, which Google characterized as "largely publicly available business information."

The incident represents a significant irony, as Google had warned other organizations about ShinyHunters' ongoing Salesforce-targeting campaign just weeks before falling victim to the same attack methods. Google has not disclosed the exact number of affected businesses, and the company's spokesperson declined to provide additional details beyond the official blog post disclosure.

The breach is part of a broader campaign by ShinyHunters that has targeted multiple major corporations including Cisco, Qantas, Allianz Life, Louis Vuitton, Dior, Tiffany & Co., and Pandora. Security researchers indicate that ShinyHunters has been conducting these attacks since early 2025, using sophisticated social engineering techniques to manipulate employees into installing malicious applications or providing credentials that grant access to Salesforce instances.

Why it Matters: This breach demonstrates that even cybersecurity-aware technology giants are vulnerable to sophisticated social engineering attacks, highlighting the threat landscape facing businesses that rely on cloud-based customer relationship management systems. The incident underscores the effectiveness of voice phishing attacks against human targets, as technical security measures cannot fully protect against employees being manipulated through convincing telephone-based social engineering. For organizations using Salesforce or similar cloud platforms, this breach serves as a critical reminder that employee training and awareness programs are essential components of cybersecurity defense strategies.

The broader ShinyHunters campaign, which has already extracted approximately $400,000 in ransom payments from at least one victim, indicates that threat actors are increasingly targeting cloud-based business systems that contain valuable customer data. Google's disclosure also reveals that ShinyHunters is preparing to escalate their extortion tactics by launching a data leak site, potentially exposing stolen information publicly if ransom demands are not met. This development poses significant risks to Australian businesses that may become targets of similar attacks, as the exposure of customer contact information could lead to regulatory penalties, reputational damage, and loss of competitive advantage in the marketplace.