Google has confirmed that it is among the victims of an ongoing data theft campaign targeting Salesforce instances.
The tech giant confirmed that data has been retrieved by the threat actor, however this was largely publicly available business information, such as business names and contact details.
The cyber-attack has been linked to ShinyHunters, tracked by the Google Threat Intelligence Group (GTIG) as UNC6040 and UN6240.
In a blog update published on August 5, Google said, “Google responded to the activity, performed an impact analysis and began mitigations. The instance was used to store contact information and related notes for small and medium businesses.”
ShinyHunters is a financially motivated threat cluster that specializes invoice phishing (vishing)campaigns specifically designed to compromise organizations’ Salesforce instances for large-scale data theft and subsequent extortion.
The vishing campaigns aim to trick victims into handing over login details and MFA codes.
ShinyHunters Preparing for Escalation
GTIG has warned that the threat actors using the ShinyHunters brand may be preparing to escalate their extortion tactics by launching a data leak site.
At the moment, their extortion tactics involve calls or emails to employees of the victim organization demanding payment in bitcoin within 72 hours.
A new leak site will increase pressure on victims, including those impacted by recent Salesforce-related data breaches.
William Wright, CEO of Closed Door Security, commented, “ShinyHunters has recently executed a huge volume of attacks via Salesforce and it is essential organizations take note of these. The threat actors have also claimed many attacks are still unreported, so we can expect more victims to be announced in coming weeks.”
Chanel and Pandora disclosed breaches of customer data linked to the ShinyHunters activity in early August 2025.
Other companies suspected to have been victimized in a similar way by ShinyHunters includeAllianz Life,Adidas,Qantasand severalLVMHbrands.
Image credit: bluestork / Shutterstock.com