ClosedHighNo fix needed
Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)
Salesforce customer instances (social engineering, not a Salesforce vulnerability)
UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).
Why this severity: Voice-phishing data theft and extortion campaign
- Started
- Jun 4, 2025
- Closed
- Aug 31, 2025
Affected
- n/a
Fixed in
No fixed release yet
Timeline3
News & write-ups4
- The Cost of a Call: From Voice Phishing to Data ExtortionGoogle Threat Intelligence · Write-up
- Hackers abuse modified Salesforce app to steal data, extort companies, Google saysReuters · Jun 4, 2025
- Google suffers data breach in ongoing Salesforce data theft attacksBleepingComputer
- Google Discloses Data Breach via Salesforce HackSecurityWeek
Notes & caveats
Campaign ran across many companies through 2025; closedAt is an approximate end of the main wave, not a confirmed end.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
