Google has provided customers with more information about the security incident in one of its business Salesforce instances. This system is used to connect with potential Google Ads customers.
According to Google, a limited set of data, including company names, phone numbers, and internal notes, was accessed by an attacker. Google says the unauthorized access was brief and that no other Google systems were accessed. There is no impact on Ads data in Google Ads accounts, Merchant Center, Google Analytics, other Ads products, or payment information.
Google says that security teams have investigated the Salesforce instance and taken additional measures. Customers do not need to take any action themselves. However, the company reiterates that it will never ask for login or payment details over the phone.
Attacks by ShinyHunters
The incident comes at a time when several large organizations have been victims of attacks on Salesforce environments. Investigations show that the group responsible is ShinyHunters, which is known for large-scale data theft and reselling information on the dark web.
In the recent attack campaign, the group used social engineering to deceive employees over the phone. They were persuaded to link a malicious application to the company’s Salesforce. This application uses legitimate functions within Salesforce, allowing the attacker to export data without exploiting technical vulnerabilities.
Air France-KLM, Cisco, LVMH, Qantas, Allianz, Adidas, Chanel, and Pandora are among the organizations affected. Although the nature and scope of the stolen data varies from company to company, it often involves customer or contact information managed through CRM systems. In all cases, ShinyHunters’ goal appears to be financial gain, with the stolen data later being used for targeted phishing or fraud attacks.
ShinyHunters’ campaign makes it clear that even companies remain vulnerable when attackers target human error and deception. According to Google, the incidents underscore the importance of strict access restrictions, multi-factor authentication, and ongoing employee training to recognize social engineering.
Google will continue to update its blog as more information about this specific incident becomes available.