Google Data Breach Tied to Salesforce Hack by ShinyHunters Group

In an update to its June advisory, Google disclosed that it, too, fell victim to a similar attack.

“In June, one of Google’s corporate Salesforce instances was compromised by UNC6040 activity,” the company stated. “The affected instance stored contact information and related notes about small and medium-sized businesses. Our investigation determined the attackers extracted data during a brief window before we terminated access. The compromised information was limited to basic, publicly available details like company names and contact information.”

While Google emphasized the limited sensitivity of the exposed data, the admission places it among a growing list of global companies affected by this campaign.

ShinyHunters’ Expanding Hit List

According to Bleeping Computer, ShinyHunters—already linked to past breaches at Oracle Cloud, Snowflake, AT&T, NitroPDF, Wattpad, and Mathway—is behind the recent wave of Salesforce-focused attacks.

The group recently told journalists that it had breached a “trillion-dollar company” and was considering leaking the stolen data without a ransom demand. Though Google was not explicitly named, the timing and circumstances align closely.

ShinyHunters is known for its classic extortion playbook:

• Breach the system
• Exfiltrate data
• Contact the victim via email
• Demand payment under threat of public release

If negotiations stall, the group either dumps the data publicly or sells it to the highest bidder.

Bleeping Computer reported that one unnamed company recently paid 4 BTC (roughly $400,000) to prevent its stolen data from being leaked.

Pattern of High-Profile Victims

This breach adds Google to a list of prominent organizations affected by similar campaigns in recent months, including:

• Adidas
• Qantas Airways
• Allianz Life
• LVMH brands (Louis Vuitton, Dior, Tiffany & Co.)
• Cisco.com
• Chanel
• Pandora (Danish jewelry company)

The incidents highlight a growing risk vector in the form of third-party platforms like Salesforce, where even basic CRM data can be exploited at scale for extortion, targeting, and brand damage.