Google Hacked, Breach Sparks Cloud Security Questions

Google has confirmed that customer data was exposed after hackers accessed one of its Salesforce database systems. The breach is a reminder of persistent vulnerabilities in third-party cloud platforms.

TechCrunch reports that the hack, attributed to the group ShinyHunters (formally designated UNC6040) targeted a corporate Salesforce instance used to store business contact details and notes for small and medium-sized companies.

ShinyHunters has repeatedly targeted major enterprises through Salesforce cloud systems. The June breach follows earlier attacks on Cisco, Qantas, and Pandora.

Investigators believe the group employs sophisticated voice phishing schemes to trick employees into granting access, an increasingly common method in cloud-based intrusions.

Google explained in a blog post that the compromised data was limited to “basic and largely publicly available” information such as company names and contact details, but declined to specify how many customers were affected.

The incident occurred in June and was quickly mitigated after Google identified unauthorized activity.

Although the company has finished notifying affected users, questions remain about whether the hackers issued any ransom demands.

Google warned that ShinyHunters may be preparing a leak site, a tactic often used to publish stolen data as leverage in extortion campaigns.

The group is known to overlap with The Com, a cybercriminal collective that has combined hacking with extortion and threats of violence.

Legal teams should note the continuing risks associated with cloud-based client data storage and the growing liability exposure when service providers are compromised.

Clients need to reassess vendor risk management, monitor phishing vulnerabilities, and prepare for potential data exposure even when only “public” business information is involved.