# Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters) · pwn.watch

> UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).

Page: https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025 · generated 2026-10-22T23:52:53.443Z

## Status
- Severity: high · status: closed · patch: no-fix-needed
- Product: Salesforce customer instances (social engineering, not a Salesforce vulnerability)
- Started: 2025-06-04 · closed: 2025-08-31
- Affected: n/a

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025/feed.xml
- JSON Feed: https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025.json
- This file: https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025/llms.txt

## Updates (newest first)
- 2025-08: Google confirms the breach exposed prospective Google Ads customers' contact info (https://www.bleepingcomputer.com/news/security/google-confirms-data-breach-exposed-potential-google-ads-customers-info/)
- 2025-06-04: Google Threat Intelligence describes UNC6040's vishing and Data Loader abuse (https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion)
- 2025-06: Google's corporate Salesforce instance breached by UNC6040 (https://www.bleepingcomputer.com/news/security/google-suffers-data-breach-in-ongoing-salesforce-data-theft-attacks/)

## Fix brief
# Security brief: Vishing campaign steals Salesforce data from Google and others (UNC6040 / ShinyHunters)

Source: https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025 · status: closed (closed Aug 31, 2025) · severity: high · updated Aug 31, 2025

## Patch status
**NO FIX NEEDED: no action on your side beyond verification.**

## What it is
UNC6040 phoned employees posing as IT support and talked them into authorizing a modified Salesforce Data Loader app, then bulk-exported their Salesforce data. Google's own corporate Salesforce instance (prospective Ads customer contacts) was hit in June 2025. Extortion followed under the ShinyHunters name (UNC6240).

Severity detail: Voice-phishing data theft and extortion campaign

- Product: Salesforce customer instances (social engineering, not a Salesforce vulnerability)

## Affected versions
- n/a

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
No fixed version is listed. Follow the vendor advisory below.

## Latest updates
- Aug 2025: Google confirms the breach exposed prospective Google Ads customers' contact info
- Jun 4, 2025: Google Threat Intelligence describes UNC6040's vishing and Data Loader abuse
- Jun 2025: Google's corporate Salesforce instance breached by UNC6040

## Write-ups & news
- [The Cost of a Call: From Voice Phishing to Data Extortion](https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion)
- [Hackers abuse modified Salesforce app to steal data, extort companies, Google says](https://www.reuters.com/sustainability/boards-policy-regulation/hackers-abuse-modified-salesforce-app-steal-data-extort-companies-google-says-2025-06-04/)
- [Google suffers data breach in ongoing Salesforce data theft attacks](https://www.bleepingcomputer.com/news/security/google-suffers-data-breach-in-ongoing-salesforce-data-theft-attacks/)
- [Google Discloses Data Breach via Salesforce Hack](https://www.securityweek.com/google-discloses-salesforce-hack/)

## Caveats
Campaign ran across many companies through 2025; closedAt is an approximate end of the main wave, not a confirmed end.

---
Machine-readable: https://pwn.watch/i/salesforce-vishing-data-theft-unc6040-2025.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.