Google reveals it became one of the Salesforce attack victims in June

**Google** disclosed that in June a corporate Salesforce CRM instance was compromised via voice-phishing intrusions attributed to **UNC6040**, enabling brief exfiltration of basic SMB contact details before access was cut; Google’s GTIG tracks ensuing extortion as **UNC6240** (72-hour bitcoin demands). **ShinyHunters** claimed involvement and plans to extort, while GTIG suggested a potential data leak site escalation (which ShinyHunters denies). The report places Google’s breach within an ongoing campaign targeting Salesforce environments for data theft and extortion.