Google’s Salesforce CRM Breach (June–August 2025)
In June 2025, a hacking group known as ShinyHunters (tracked as UNC6040) successfully compromised one of Google’s corporate Salesforce instances. They executed a voice-phishing attack (vishing), tricking a Google employee into installing a malicious version of the Salesforce Data Loader app, granting the attacker unauthorized access.
What was exposed
The breach exposed basic business contact information—company names, phone numbers, notes—for small and medium-sized businesses (SMBs). Importantly, this did not include Gmail account passwords, billing details, or other highly sensitive personal data.
Timing and impact
Google completed notifying affected users by August 8, 2025, and publicly confirmed the incident in early August.
Risk factor
The main concern isn’t stolen passwords, it’s the risk of phishing and social engineering attacks using the leaked contact info.
Affected organizations
Notably, Zscaler disclosed that its Salesforce instance was breached in this campaign, resulting in disclosure of customer support case details, business emails, job titles, phone numbers, product data, and regional info. They’ve since revoked integrations and rotated keys.
Response
Salesloft and Salesforce revoked all Drift-related tokens and removed the app from their marketplace. Companies were instructed to revoke credentials, rotate API keys, review logs, and monitor for further unauthorized access.
What You Must Do Now
If your organization uses Salesforce or any third-party integrations like Salesloft Drift:
- Audit all connected apps. Deny unnecessary access, apply least privilege.
- Revoke and rotate OAuth tokens, API keys, and credentials linked to Salesforce.
- Monitor logs for unusual access or SOQL queries, especially deletions or exports.
- Train your team. Social engineering remains the biggest risk.
- Review support case security. Ensure no sensitive customer info is stored insecurely.
