Google Customer Data Stolen in Salesforce Database Hack

Google has now acknowledged that a recent breach of one of its databases resulted in the theft of some customer data as a cybercriminal hacking organisation reportedly gained access to one of Google’s Salesforce database systems, which housed data about small and medium-sized enterprises.

This year, a surge of social engineering hacks has targeted big corporations, including Google and Google Threat Intelligence Group has come to say in a blog post late Tuesday that a hacker collective known as ShinyHunters, officially known as UNC6040, had compromised one of its Salesforce database systems, which are used to store contact details and related notes for small and medium-sized businesses.

The company stated that the threat actor’s data was limited to basic and widely accessible business information, including contact details and company names.

For “a small window of time before the access was cut off,” Google added, the hackers gained access to the database, mostly stealing “basic and largely publicly available business information.”

Google spokesperson Mark Karayan declined to comment outside of the company’s blog post, and the company did not reveal the number of impacted consumers. It’s unclear if the business has heard anything, like a demand for ransom.

It is well known that ShinyHunters targets large corporations and their cloud-based databases.

Bleeping Computer reports that this is the most current in a string of hacks that target Salesforce cloud services, following recent thefts of client data from Cisco, retail behemoth Pandora, and airline behemoth Qantas, among others. According to Google’s blog post, the ShinyHunters organisation relies on voice phishing techniques to deceive company employees into providing them access to their cloud-based Salesforce databases.

A data leak website, which some ransomware gangs use to disseminate stolen data and pressure its corporate victims into paying a ransom, is probably being prepared by the ShinyHunters organisation, according to Google. According to reports, the gang overlaps with other organisations, such as The Com, a well-known collective of cybercriminals that breach networks through extortion, hacking, and occasionally threats of murder.

In summary, the cybercriminal organisation ShinyHunters is well-known for using social engineering to infiltrate businesses.

In the majority of schemes, they will use voice phishing techniques to mimic an organization’s IT help desk and fool an employee into changing their password.

Additionally, ShinyHunters deceives these workers into allowing a malicious application to be installed on their computers, which the hackers use to get access to and steal confidential data.

In order to stop the stolen material from being published, ShinyHunters will call or email staff members, frequently months after the data has been extracted, and demand a ransom payment.

ShinyHunters has been connected to multiple data breaches at Adidas, Louis Vuitton, Allianz Life, and Australian airline Qantas so far this year.

Social engineering and hacked Salesforce systems were used in each of those intrusions.

Whether Google was demanded to pay a ransom for the stolen data is still unknown.