Google has confirmed that a breach of its Salesforce environment occurred in June 2025, involving the theft of user information related to small and medium businesses. The breach was attributed to a financially motivated threat group known as UNC6040, which is linked to the notorious ShinyHunters cybercriminal organization. According to a statement from Google’s Threat Intelligence Group (GTIG), the compromised Salesforce instance contained basic business information, including company names and related notes, which are largely publicly available. This incident highlights the growing trend of voice phishing attacks targeting enterprise cloud environments. 'The data retrieved was confined to basic and largely publicly available business information,' Google stated in its disclosure. The attack was characterized by sophisticated social engineering tactics, where attackers impersonated IT support personnel to manipulate employees into granting access to malicious applications. The intrusion occurred within a limited time frame before access was terminated, allowing the attackers to exfiltrate data during this window.
The breach is part of an ongoing campaign targeting Salesforce instances, with Google noting that it is not the only victim; companies such as Qantas and Pandora have also reported similar incidents. 'This breach is the latest in a string of attacks targeting Salesforce environments,' noted David Stuart, a cybersecurity evangelist at Sentra. Google’s security team acted quickly to address the situation, conducting a comprehensive impact analysis and implementing mitigation measures immediately after detecting the breach. However, the company declined to disclose further details about the incident, including whether any ransom demands were made.
The method of attack involved voice phishing, in which attackers used convincing tactics to impersonate IT personnel and gain unauthorized access to Salesforce environments. Once access was granted, the attackers employed a modified version of Salesforce’s official Data Loader tool to facilitate data exfiltration. They disguised this malicious application under misleading names to align with their vishing pretext. 'The attackers typically target employee accounts to gain initial access,' Google explained.
In response to the breach, organizations are advised to enhance their employee training on recognizing social engineering tactics and to implement stricter access controls within their cloud applications. Google’s prompt response indicates a proactive approach to addressing the breach, but the incident serves as a reminder of the vulnerabilities present within cloud-based services and the need for continuous vigilance against such evolving threats.
