Today's cybersecurity headlines are brought to you by ThreatPerspective

Google Confronts Extortion Threat Following Salesforce CRM Data Breach

Google has confirmed a significant data breach in its Salesforce CRM instance, exposing sensitive information of prospective Google Ads customers. The company is facing an extortion threat from ShinyHunters, a financially motivated group that uses voice phishing tactics to target Salesforce systems for large-scale data theft and extortion. Financial data was not impacted, but the incident highlights the importance of maintaining a strong cybersecurity posture.

On August 10, 2025, Google confirmed a significant data breach in its Salesforce Customer Relationship Management (CRM) instance, exposing sensitive information of prospective Google Ads customers. This incident has put the tech giant on high alert as it faces an extortion threat from a group known as ShinyHunters.

According to the context provided, ShinyHunters is a financially motivated group that uses voice phishing tactics to target Salesforce systems for large-scale data theft and extortion. In this case, they claim to have accessed around 2.55 million records belonging to Google Ads customers. These records include business names, phone numbers, and related notes for a Google sales agent to contact them again.

Google's Threat Intelligence Group has confirmed that one of its Salesforce database systems was breached by ShinyHunters. The attackers used a custom tool to exfiltrate data from the compromised system in a more efficient manner. The incident highlights the vulnerability of CRM instances to sophisticated cyber attacks and the need for robust security measures to protect sensitive customer information.

It is worth noting that financial data was not impacted, and the breach did not affect Google Ads Account, Merchant Center, or other Ads products. However, the incident has raised concerns about the potential for further attacks and the importance of maintaining a strong cybersecurity posture.

The extortion threat from ShinyHunters has added an extra layer of complexity to this already concerning situation. The attackers initially demanded $2.3 million in cryptocurrency but later claimed it was a prank. However, their intention remains clear: to use the stolen data for financial gain.

Google has notified impacted individuals and is taking steps to mitigate the damage caused by the breach. The company's Threat Intelligence Group is also tracking ShinyHunters, a financially motivated group that uses voice phishing tactics to target Salesforce systems for large-scale data theft and extortion.

The incident serves as a reminder of the importance of robust cybersecurity measures and regular vulnerability assessments in protecting sensitive customer information. It also highlights the need for organizations to stay vigilant against emerging threats and take proactive steps to prevent similar incidents in the future.