Google Confirms Data Theft By ShinyHunters

Google confirmed that its Salesforce system experienced a breach in June when hackers used phone scams to steal customer contact information, and threatened to leak the data publicly.

Google has confirmed that it was among the latest victims of a widespread data breach targeting companies using Salesforce CRM systems. The attacks are part of a global extortion campaign linked to a hacking group known as ShinyHunters, who Google tracks under the codename UNC6040.

“In June, one of Google’s corporate Salesforce instances was impacted by similar UNC6040 activity described in this post. Google responded to the activity, performed an impact analysis and began mitigations,” the company said in an update.

The breach exposed contact information and related notes of small and medium-sized businesses, which Google described as “basic and largely publicly available business information, such as business names and contact details.” The data was accessed only briefly before Google shut down access.

The attackers used voice phishing (vishing) as a social engineering tactic to impersonate IT support staff, and trick employees into granting access. The attackers deceived victims into authorizing a fake version of Salesforce’s “Data Loader” application, which eventually allowed them to steal sensitive data.

In some cases, data was only partially exfiltrated before detection; in others, entire datasets were taken.

Google suspects ShinyHunters may now escalate the attacks by launching a public data leak site, putting even more pressure on victims.  According to BleepingComputer, the group has conducted previous cyberattacks against major companies including Cisco and Adidas and Louis Vuitton.

BleepingComputer also notes that one company has already paid a ransom of 4 Bitcoins (around $400,000) to prevent data exposure.

The incident shows a troubling trend where criminal groups use phone scams to target support staff. Salesforce has become a preferred system for these breaches. Google and cybersecurity experts predict additional attacks will occur throughout the upcoming months so businesses need to remain vigilant.