Google warns Gmail users after Salesforce breach tied to ShinyHunters

Google warned Gmail users this month that a prolific hacking group is targeting accounts after accessing a corporate Salesforce database, and advised millions to tighten their security immediately. The company said threat actors using the ShinyHunters name exploited a Salesforce instance and that the resulting data exposure has been used to mount phishing and social engineering campaigns that put Gmail and Google Cloud users worldwide at heightened risk.

Google’s Threat Intelligence Group said the Salesforce breach, first flagged in June and reported to affected users by email on August 8, contained basic business contact information rather than account passwords. Still, the company confirmed in August that compromised passwords remain a leading cause of successful account takeovers, accounting for roughly 37 percent of intrusions, and that attackers have used that information to craft convincing impersonation attempts. Google additionally warned that actors may be preparing to escalate extortion tactics by launching a data leak site.

Security firms and user reports describe multiple attack methods. Criminals are sending realistic-looking emails and placing phone calls...