Google says threat actor accessed some customers’ data in recent breach

In a blog post released Tuesday night, Google (GOOG) said that, in June, one of its corporate Salesforce (CRM) instances was impacted by UNC6040 activity. Google Threat Intelligence Group tracks the extortion activities following UNC6040 intrusions, sometimes several months after the initial data theft, as UNC6240. The extortion involves calls or emails to employees of the victim organization demanding payment in bitcoin within 72 hours. During these communications, UNC6240 has consistently claimed to be the threat group ShinyHunters. Google responded to the recent activity, performed an impact analysis and began mitigations. The instance was used to store contact information and related notes for small and medium businesses. Analysis revealed that data was retrieved by the threat actor during a small window of time before the access was cut off. The data retrieved by the threat actor was confined to basic and largely publicly available business information, such as business names and contact details.