Google has confirmed that attackers gained access to one of its corporate Salesforce systems, exposing contact details and business information. While the company insists that no Gmail or Google Cloud customer data was directly compromised, the fallout has been significant, with scammers already exploiting the breach to target users worldwide.
In a statement, Google explained: “In June, one of Google’s corporate Salesforce instances was impacted by similar UNC6040 activity described in this post. Google responded to the activity, performed an impact analysis and began mitigations.”
The company clarified that the affected system contained only “basic and largely publicly available business information, such as business names and contact details.”
Google has stressed that passwords, payment details, and personal Gmail or Google Cloud data were not exposed.
Despite Google’s assurances, attackers have been quick to turn the breach into an opportunity. Reports across Reddit and cybersecurity forums describe a rise in phishing and vishing attacks. These include fake emails warning of suspicious sign-ins and scam phone calls from numbers linked to Google’s California area code.
Victims say the callers pretend to be Google staff, claiming their Gmail accounts are under attack. They then pressure users into “resetting” their passwords and sharing the new credentials, effectively locking account holders out of their own inboxes.
ShinyHunters behind the attack
Security researchers and multiple reports link the breach to the notorious hacker collective ShinyHunters, also known as UNC6040. The group is known for large-scale corporate breaches, including attacks on Allianz Life, Cisco, Qantas, and Louis Vuitton earlier this year.
With Gmail and Google Cloud serving around 2.5 billion people worldwide, the potential scale of the threat is significant. While no passwords were stolen in the breach itself, the leaked business information provides criminals with enough context to create highly convincing scams.
How to stay safe
Google has urged users to strengthen account protections and remain alert. The company recommends:
- Running a Google Security Checkup to spot suspicious activity.
- Enabling two-factor authentication or passkeys for stronger login security.
- Being skeptical of unsolicited calls or emails claiming to be from Google, especially requests to reset passwords.
Experts also advise avoiding outdated cloud storage addresses, sometimes referred to as “dangling buckets,” which hackers exploit to inject malware or steal data.
This breach highlights the continued effectiveness of social engineering as a hacking method. Though Google contained the breach and insists no sensitive consumer data was taken, the wave of scams shows how quickly attackers can weaponize even partial leaks.