2025 Google — Salesforce CRM breach via UNC6040/ShinyHunters vishing wave
Data compromised
Business names and contact details per Google impact analysis
Technical writeup
Google confirmed in August 2025 that one corporate Salesforce instance was breached in June 2025 during the UNC6040 voice-phishing campaign that BleepingComputer tied to ShinyHunters extortion against multiple Salesforce tenants. Google said the instance stored SMB contact information and related notes; retrieved data was largely basic business contact fields. Access was cut off quickly after detection.
Root cause
Voice phishing compromising employee credentials leading to Salesforce data theft