Google Confirms Customer Data Theft by ShinyHunters from Salesforce Database

Google has confirmed that a recent breach of its Salesforce database resulted in the theft of customer information. The company's threat intelligence team disclosed in a blog post that the attack was carried out by a hacker group known as "ShinyHunters," also referred to by the formal designation UNC6040. This group targeted a Salesforce database system used to store contact information and related records of small and medium-sized enterprises.

The compromised data is reported to be limited to basic and mostly publicly available commercial information, such as company names and contact details. Google has not disclosed the number of affected customers, and a company spokesperson did not immediately respond to requests for comment. It is also unclear whether the company has received any demands, such as ransom requests.

ShinyHunters is notorious for targeting large corporations and their cloud databases. This incident is part of a series of breaches targeting Salesforce cloud systems. Recently, companies such as Cisco, the airline giant Qantas, and the retail giant Pandora have also had customer data stolen. According to Google's blog post, ShinyHunters used voice phishing techniques to trick company employees into granting them access to the cloud-based Salesforce database.

Google has indicated that ShinyHunters may be preparing a data leak site, which some ransomware groups use to publish stolen data and pressure corporate victims into paying ransoms. The group is reportedly linked to other criminal organizations, including "The Com," a well-known cybercrime syndicate that uses hacking, ransomware, and sometimes violent threats to infiltrate networks.

This breach underscores the persistent threat of cyber-attacks and the critical need for robust data protection measures. Companies must remain vigilant and proactive in safeguarding customer data to maintain trust and avoid potential legal and financial repercussions. The incident serves as a reminder of the importance of continuous monitoring and improvement of cybersecurity protocols to protect against evolving threats.