A massive cyberattack has left more than 2.5 billion Gmail users exposed, after hackers managed to compromise a Google database hosted on Salesforce’s cloud platform. The breach, tied to the notorious hacking group ShinyHunters, is already being called one of the biggest in Google’s history.
How the Breach Happened
The attack began in June 2025 and relied on social engineering—a common but dangerous tactic. Members of ShinyHunters pretended to be IT staff, making convincing phone calls to Google employees. Eventually, they tricked one employee into approving a malicious Salesforce application.
Once inside, the hackers were able to extract contact information, business names, and related notes from the database.
Google confirmed that no passwords were stolen, but the exposed data is already fueling new scams. On Reddit and other forums, Gmail users have reported a flood of phishing emails, fake calls, and text scams. Many attackers are impersonating Google staff, trying to steal login codes or push users into resetting their accounts—opening the door to full account takeovers.
Why This Matters
Even though no passwords were leaked, the stolen details are still extremely dangerous. Scammers can:
-
Impersonate Google support to trick you into revealing login details.
-
Pressure you into sharing files or sensitive data.
-
Launch brute-force attempts on weak passwords like “123456” or “password”.
If successful, attackers can lock victims out of their Gmail accounts, steal personal photos and documents, and even access linked financial accounts or business systems.
What You Should Do Now
Here are the key steps every Gmail user should take:
-
Check if your Gmail data was leaked – Use a tool like ID Protection’s Data Leak Checker or dark web monitoring to see if your details are being sold.
-
Update your password immediately – Use a strong, unique password generated with a free tool like ID Protection’s Password Generator. Never reuse old passwords.
-
Enable Multi-Factor Authentication (MFA) – This adds an extra layer of security, making it much harder for hackers to break in.
-
Use scam detection tools – Services like Trend Micro ScamCheck can block fake calls, filter suspicious texts, and flag scam emails.
-
Verify suspicious emails – If an email claims to be from Google but looks odd, don’t click anything. Instead, upload it to ScamCheck to verify if it’s fraudulent.
-
Switch to passkeys – Google recommends moving to passkeys (fingerprint or face ID logins) since they’re more secure and phishing-resistant.
Finally, run a Google Security Checkup to review your current protections and enable any extra safeguards available.
Google’s Response
On August 8, 2025, Google began notifying affected users. The company stated that most of the exposed data was “publicly available business information,” but security experts warn that even simple contact details can be exploited in targeted scams.
Unfortunately, this isn’t the first time Google has faced a security issue. Previous incidents include the Google+ API leak (2018), the OAuth Gmail phishing campaign (2017–2018), and the Gooligan malware outbreak (2016). Each case highlights the same reality: hackers don’t always need passwords to cause damage.
Who’s Behind It?
The breach has been linked to ShinyHunters, also known as UNC6040. This group is notorious for corporate breaches and extortion. Their go-to method is impersonating IT staff to trick employees into granting access to malicious Salesforce apps. Once inside, they extract massive amounts of data using tools similar to Salesforce’s own “Data Loader.”
In some cases, the stolen data isn’t used right away. A related group, UNC6240, has been known to approach victims months later, demanding Bitcoin payments in exchange for not leaking sensitive data. Security researchers believe this group may soon launch a dedicated leak site to escalate its extortion campaigns.
Final Thoughts
This breach is a strong reminder that even trusted platforms like Google can be vulnerable. The best defense is staying proactive: secure your Gmail with strong passwords, MFA, and scam filters—and stay alert to suspicious messages or calls.
🔒 Your online safety starts with awareness. Share this article with friends and family so they can protect themselves too.