Jun 4, 2025
1 new incident, 0 with updates.
Started
- ClosedHighNo fix needed
Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)
UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).
Salesforce customer instances (social engineering, not a Salesforce vulnerability)Closed Aug 31, 2025
