Google has confirmed that a group known as UNC6040, linked to the notorious ShinyHunters, breached one of its Salesforce databases, stealing data from small and medium business customers.

In June 2025, Google alerted that UNC6040 was employing voice phishing tactics to exploit employees and gain access to Salesforce data.

On August 5, 2025, Google disclosed that its Salesforce instance was hacked in June by UNC6040, which is part of a broader campaign targeting multiple companies.

The stolen customer data is reportedly being used to extort companies, with ransom demands aimed at preventing the public release of the information.

The attackers likely gained access through social engineering tactics and may be planning to launch a data-shaming site to further extort victims.

Connections have been noted between UNC6040 and other cybercrime groups, including Scattered Spider and ShinyHunters, which are known for extortion attempts following data breaches.

ShinyHunters has a history of targeting major companies and is currently extorting affected organizations for ransom to prevent data leaks.

During the breach, hackers accessed basic contact information of small and medium businesses, including business names and contact details, before access was terminated.

Google has indicated that ShinyHunters may escalate their extortion tactics by launching a data leak site, a common strategy used by ransomware groups.

Google has not disclosed the number of affected customers or confirmed whether a ransom demand was made following the data breach.

Salesforce confirmed that its systems were not breached, attributing the incidents to sophisticated phishing and social engineering attacks targeting its customers.

The ongoing hacking campaign has also affected other major companies, including Adidas, Cisco, and LVMH subsidiaries such as Louis Vuitton and Dior.