InfoSecBulletin Cybersecurity for mankind
Google confirmed that a recent data breach in one of its Salesforce CRM systems exposed information about potential Google Ads customers.
“We’re writing to let you know about an event that affected a limited set of data in one of Google’s corporate Salesforce instances used to communicate with prospective Ads customers,” reads a data breach notification shared.
Hacker claim to access Rajasthan Police data: 70,000 records allegedly exposed
Update now! PHP2Shell: Critical PHP vulnerabilities patched
Trump says data centres should pay dividends to local community
Hackers Actively Exploiting Palo Alto VPN Flaw Via CVE-2026-0257
DeepSeek AI banned by U.S. Government; federal agencies must remove all related tools
CISA, NSA and NIST Publish New 10 AI Agent Control Guidelines
Claude AI Cracks 25-Year NSA Cryptography Number Mystery in Just 30 Minutes
Bypassing firewalls, AI Agents Accessed Indian ‘ Data Without Permission: CERT-In
MITRE ATT&CK v20 Unveils 9 New Attack Techniques On AI Exploits, MFA Bypass, and CAPTCHA Evasion
Hackers Exploit Fortinet Flaws to Deploy Stealthy PEERSTITCH Malware on FortiGate Firewalls
“Our records indicate basic business contact information and related notes were impacted by this event.”
Google says the exposed information includes business names, phone numbers, and “related notes” for a Google sales agent to contact them again.
The company stated that payment information wasn’t compromised and there is no effect on Ads data in Google Ads, Merchant Center, Google Analytics, or other Ads products.
The breacShinyHunters, a group of threat actors, has been carrying out data theft attacks against Salesforce customers.
Google hasn’t revealed how many people were affected, but ShinyHunters claims that about 2.55 million data records were stolen. It’s uncertain if these records include duplicates.
ShinyHunters further told BleepingComputer that they are also working with threat actors associated with “Scattered Spider, who are responsible for first gaining initial access to targeted systems.
“Like we have said repeatedly already, ShinyHunters and Scattered Spider are one and the same,” ShinyHunters told.
“They provide us with initial access and we conduct the dump and exfiltration of the Salesforce CRM instances. Just like we did with Snowflake.”
the threat actors now call themselves “Sp1d3rHunters” to show the group of people involved in these attacks.
The threat actors trick employees into giving their login info or connecting a fake Salesforce app to their accounts.
The threat actors then steal the entire Salesforce database and demand a ransom via email, threatening to publish the stolen data if it’s not paid.
These Salesforce attacks were first reported in June, with Google experiencing similar issues a month later.
Databreaches.net reported that the threat actors have already demanded a ransom from Google. After the story was published, ShinyHunters told BleepingComputer that they asked for 20 Bitcoins, or about $2.3 million, from Google to keep the data private.
“I don’t care about ransoming Google anyway, I just sent them a bogus email for the lulz of it,” said the threat actor.
ShinyHunters says they have since switched to a new custom tool that makes it easier and quicker to steal data from compromised Salesforce instances.
In an update, Google recently acknowledged the new tooling, stating that they have seen Python scripts used in the attacks instead of the Salesforce Data Loader.
