Google Falls Victim to Salesforce Data Theft Attacks

Google has recently become a casualty in a string of data theft incidents involving Salesforce CRM, orchestrated by the notorious group known as Shinyhunters.

According to a report, Google disclosed that it suffered a data breach back in June. This incident is part of a larger wave of similar attacks against various organizations, all attributed to the Shinyhunters group.

Google stated that one of its Salesforce platforms was compromised in June, enabling attackers to extract customer data before access was swiftly terminated. Fortunately, the stolen information mainly included basic public business data, like company names and contact information.

The tech giant has identified the attackers involved as “UNC6040” or “UNC6240.” However, sources like BleepingComputer assert that Shinyhunters is indeed responsible for the breach. This group has a checkered past, having targeted organizations such as Powerschool, Oracle Cloud, and many others.

In discussions with BleepingComputer, Shinyhunters claimed to have targeted multiple Salesforce instances, indicating that their assault is ongoing. While they did not specifically confirm Google’s involvement, there were hints pointing towards the tech giant.

Shinyhunters employs a technique that involves Vishing, a form of social engineering that deceives employees into providing access to Salesforce accounts. Once access is granted, they proceed to download sensitive customer data and then leverage that information to extort ransom payments to prevent the data’s release.

Reports indicate at least one company has already paid around four bitcoins—approximately $400,000—to avert data exposure. Other notable victims include several LVMH subsidiaries, along with recognizable names like Adidas, Qantas, and Cisco.