Google data breaches: the 2025 Salesforce theft, Operation Aurora, and what was not a breach
Google sells Google Security Operations (formerly Chronicle), owns Mandiant and runs Workspace and Google Cloud. In 2025 its own threat-intelligence team disclosed that a Google corporate Salesforce instance had been hit by the same voice-phishing crew it was warning everyone else about. This page dates each incident to Google’s own words and keeps the attacker’s claims separate.
Short answer
Was Google hacked?
Yes. Google said that in June 2025 one of its corporate Salesforce instances, used to store contact information and notes for small and medium businesses, was hit by activity like that of UNC6040, a voice-phishing group linked to the ShinyHunters brand. Google said data was retrieved “during a small window of time before the access was cut off” and was “confined to basic and largely publicly available business information, such as business names and contact details”.
Google disclosed this in an update on 5 August 2025 and said it had finished notifying affected people by 8 August. In January 2010 Google also disclosed “a highly sophisticated and targeted attack on our corporate infrastructure originating from China” that resulted in theft of intellectual property, later known as Operation Aurora. Google says the 2025 Salesloft Drift campaign did not compromise Google Workspace or Alphabet itself.
Timeline at a glance
12 Jan 2010Google discloses a China-origin attack on its corporate infrastructure and theft of IP (Operation Aurora). (Google blog)Confirmed
3 Jan 2024Mandiant’s X account hijacked by brute force to push a crypto drainer. (The Register)Confirmed
Jun 2025UNC6040-style vishing reaches a Google corporate Salesforce instance; SMB contact data taken. (Google Threat Intelligence)Confirmed
Aug 2025ShinyHunters behind the Salesforce attacks, sending extortion emails. (BleepingComputer)Reported
28 Aug 2025Drift campaign touched a few customer Workspace accounts; Google says Workspace and Alphabet not compromised. (Google Threat Intelligence)Not a breach
Last updated 1 November 2026. Every entry is dated and linked to its source; claims by attackers are labelled as claims, never stated as fact.
Google incident timeline, in detail
Confirmed = acknowledged by Google, a regulator filing or a court. Reported = credible reporting Google has not fully confirmed. Unverified claim = an attacker or leak-site claim.
Jun – Aug 2025ConfirmedSocial engineering / SaaS data theft
Voice phishing reaches a Google corporate Salesforce instance; SMB contact data taken
What happened. Google’s Threat Intelligence Group had warned in June 2025 that UNC6040 calls employees posing as IT support and persuades them to connect a malicious version of Salesforce’s Data Loader app. Its 5 August 2025 update said that in June one of Google’s own corporate Salesforce instances was impacted by similar activity, and that Google responded, performed an impact analysis and began mitigations.
Impact. Google said the instance stored contact information and related notes for small and medium businesses, and the data taken was “basic and largely publicly available business information, such as business names and contact details”. It said notifications were completed by 8 August. BleepingComputer reported ShinyHunters was behind the wave and was emailing victims extortion demands.
Dec 2009 – Jan 2010ConfirmedNation-state intrusion
Operation Aurora: China-origin attack steals Google intellectual property
What happened. On 12 January 2010 Google said it had detected, in mid-December, “a highly sophisticated and targeted attack on our corporate infrastructure originating from China that resulted in the theft of intellectual property from Google”, and that the Gmail accounts of dozens of human rights activists had been accessed. The campaign, named Operation Aurora by McAfee, reportedly targeted more than 20 other companies.
Impact. In 2013 the Washington Post reported, citing current and former officials, that the attackers reached a database of US surveillance targets; Google has not confirmed that.
Mandiant’s X account hijacked to promote a crypto drainer
What happened. Mandiant, owned by Google, said its @Mandiant X account was taken over on 3 January 2024, likely through a brute-force password attack, and used to promote a cryptocurrency drainer phishing page. Mandiant said two-factor authentication would normally have stopped it but that, due to team transitions and a change in X’s 2FA policy, the account was not adequately protected.
Impact. Mandiant said the hijack was limited to that one social account.
Record counts: Google has not given a number of records or businesses affected in the 2025 Salesforce theft; figures circulated by the attackers are unverified.
Drift: some coverage lists Google among Salesloft Drift victims. Google says it has not been a Salesloft Drift customer and that there was no compromise of Google Workspace or Alphabet; a very small number of customers’ Workspace accounts integrated with Drift were accessed.
Aurora’s target: Google described IP theft and activists’ Gmail accounts; the surveillance-database detail is press reporting from 2013.
The pattern across the record
The phone is the weak link, even at a threat-intel company
Google published the warning about UNC6040’s vishing in June 2025 and was hit by the same technique the same month. No exploit was needed; an employee was talked into authorising an app.
Small breaches at big vendors still feed phishing
Contact details for small businesses are low-value on their own but make Google-branded phishing much more convincing.
What it means for Google customers — and what to do
If you use Google Security Operations, Mandiant services or Google Cloud, none of these incidents touched those platforms, per Google. The useful work is on the access paths the 2025 attackers used everywhere else.
1.Lock down connected apps in your own SaaS
UNC6040 worked by getting staff to authorise a fake Data Loader. Restrict who can approve connected apps in Salesforce and Workspace, and review existing OAuth grants.
Yes. Google said a corporate Salesforce instance holding contact information and notes for small and medium businesses was accessed in June 2025 by a voice-phishing group, and basic, largely public business contact data was taken.
Who hacked Google’s Salesforce?+
Google attributes it to activity like UNC6040, a financially motivated vishing group; BleepingComputer reported the ShinyHunters extortion group was behind the wave.
Were Gmail or Google Cloud accounts affected?+
Google has not said that any Gmail, Workspace or Google Cloud customer accounts were compromised in the Salesforce incident. It said the data was basic business contact information.
Was Google affected by the Salesloft Drift breach?+
Google says it was not a Drift customer and that Google Workspace and Alphabet were not compromised; a very small number of customer Workspace accounts that had integrated Drift Email were accessed.
What was Operation Aurora?+
A China-origin attack on Google’s corporate infrastructure, disclosed on 12 January 2010, that stole intellectual property and accessed some human rights activists’ Gmail accounts. More than 20 other companies were reportedly targeted.
Independent analysis for security-leadership education; not affiliated with or endorsed by Google. Facts are attributed to the dated sources above, and anything disputed or unconfirmed is labelled as such. See the full Breach Index.
🖤 Black Friday: new customers get 3 months of Pro for $5, then $5/month. Ends 30 Nov. Claim 3 months for $5 →