Google Issues Emergency Warning to Over 2.5 Billion Gmail Users After Salesforce-Linked Breach

Google has issued an emergency security alert to more than 2.5 billion Gmail users following a major breach within one of its Salesforce-based systems. While Google insists that its core infrastructure remains secure, the incident has heightened the threat landscape—particularly susceptibility to phishing, vishing (voice phishing), and extortion campaigns.

The breach reportedly traces back to a cyberattack led by the group ShinyHunters, which tricked an employee into installing malicious software via a phone-based social engineering attack. This compromised one of Google’s Salesforce cloud instances.

Although the stolen data consisted mainly of business contact information (not passwords or account contents), attackers have increasingly used this information to fuel targeted campaigns against Gmail users.

Google’s Response & User Recommendations

To counter the rising threat, Google has urged users to take several precautionary measures:

• Change passwords immediately and use strong, unique credentials.
• Enable two-factor authentication (2FA)—with preference for app-based 2FA or passkeys over SMS.
• Stay vigilant for phishing emails, vishing calls, and suspicious account activity.
• Regularly run Google’s Security Checkup and consider enrolling in the Advanced Protection Program for added security.

Experts caution that the breach’s fallout is enabling attackers to craft highly convincing phishing and vishing campaigns:

• Attackers are impersonating Google support, leveraging the recent headlines around the breach to instill urgency and trick Gmail users into revealing credentials or authentication codes.
• Some campaigns reportedly include calls from numbers with a 650 area code, designed to appear as local Silicon Valley support lines.

The hacker group ShinyHunters (also known as UNC6040) has a history of orchestrating massive data thefts and extortion attempts targeting major corporations:

• Their previous targets include AT&T, Microsoft, Ticketmaster, and others.
• In this instance, ShinyHunters may be planning to escalate their pressure through a data leak site (DLS) to extort victims.

This incident underscores that even without a direct breach of Gmail, supply chain vulnerabilities and third-party compromises can expose users to serious risks. The key defense lies in adopting proactive, layered security:

• Update your password, enable strong authentication, review devices and account recovery options, and remove unnecessary third-party app access.
• Never trust unsolicited calls from purported Google personnel—Google will never call you first about security issues.

By following these steps, Gmail users can reduce their exposure to phishing and social engineering attacks—and stay one step ahead of those seeking to exploit the chaos caused by the breach.