Google Data Breach: Hackers Stole Customer Data via Salesforce

Google Confirms Data Breach Affecting Customer Information

Recent security incidents have led to the confirmation by Google that a breach occurred, resulting in the compromise of certain customer data.

According to a post published late Tuesday by the Google Threat Intelligence Group, a database system utilized for storing contact details and associated notes for small and medium-sized enterprises was accessed without authorization.

Details of the Breach

The hacking group responsible, known as ShinyHunters (formally identified as UNC6040), successfully infiltrated one of Google’s Salesforce database systems.

Google clarified that the information obtained by the threat actor was limited to fundamental business details, primarily consisting of publicly accessible data like company names and contact information.

The exact number of customers impacted by this incident has not been revealed. A Google representative, Mark Karayan, refrained from providing further commentary beyond the official blog post.

ShinyHunters and Recent Trends

It remains uncertain whether Google has been contacted by the perpetrators with any demands, such as a ransom request.

ShinyHunters has established a reputation for targeting large organizations and their cloud-based databases.

This breach is part of a growing pattern of incidents affecting Salesforce cloud systems. Similar data thefts have recently been reported at Cisco, Qantas, and Pandora, as detailed by Bleeping Computer.

Tactics and Potential Outcomes

Google’s investigation indicates that ShinyHunters employs voice phishing, or “vishing,” to deceive employees into granting unauthorized access to Salesforce databases.

The company believes the group is currently preparing a data leak site. Such sites are commonly used by ransomware groups to publicly release stolen data, pressuring victims to pay a ransom.

There are reported connections between ShinyHunters and other cybercriminal collectives, including The Com, a group known for utilizing hacking, extortion, and even threats of violence to gain network access.

Contact Information: Individuals with information regarding this data breach, or those who have been directly notified by Google, are encouraged to reach out securely via encrypted message to zackwhittaker.1337 on Signal.

This article was updated to include a response from Google.