Google says hackers stole its customers’ data in a breach of its Salesforce database

Google has confirmed that some customers’ information has been stolen in a recent breach of one of its databases.

In a blog post late on Tuesday, Google’s Threat Intelligence Group said one of its Salesforce database systems, used to store contact information and related notes for small and medium businesses, was breached by a hacking group popularly known as ShinyHunters, formally designated as UNC6040. 

“The data retrieved by the threat actor was confined to basic and largely publicly available business information, such as business names and contact details,” the company said.

Google did not disclose how many customers are affected, and a company spokesperson did not immediately respond to a request for comment. It’s not clear if the company has received any communication, such as a ransom demand. 

ShinyHunters is known for targeting big companies and their cloud-based databases.

This is the latest in a series of breaches targeting Salesforce cloud systems, after recent thefts of customer data from Cisco and airline giant Qantas, retail giant Pandora, among others, as reported by Bleeping Computer. According to Google’s blog post, the ShinyHunters group relies on voice phishing techniques to trick company employees into granting them access to their cloud-based Salesforce databases.

Google said the ShinyHunters group is likely preparing a data leak site, which some ransomware gangs use to publish stolen data to extort their corporate victims into paying a ransom. The group is said to have overlaps with other groups, including The Com, a known collective of cybercriminals who use hacking, extortion and sometimes threats of violence to break into networks.

Do you know more about the Google data breach? Have you been notified by Google? Securely contact this reporter via encrypted message at zackwhittaker.1337 on Signal.