Inside the ShinyHunters Breach

Inside the ShinyHunters Breach: How a Cybercrime Collective Outsmarted Google

By Skeeter Wesinger

August 26, 2025

In June 2025, a phone call was all it took to crack open one of the world’s most secure companies. Google, the billion-dollar titan that built Chrome, Gmail, and Android, didn’t fall to an exotic zero-day exploit or state-sponsored cyberweapon. Instead, it stumbled over a voice on the line.

The culprits were ShinyHunters, a name that has haunted cybersecurity teams for nearly half a decade. Their infiltration of Google’s Salesforce system—achieved by tricking an employee into installing a poisoned version of a trusted utility—didn’t yield passwords or credit card numbers. But what it did uncover, millions of names, emails, and phone numbers, was enough to unleash a global phishing storm and prove once again that the human element remains the weakest link in digital defense.

ShinyHunters first burst onto the scene in 2020, when massive troves of stolen data began appearing on underground forums. Early hits included databases from Tokopedia, Wattpad, and Microsoft’s private GitHub repositories. Over time, the group built a reputation as one of the most prolific sellers of stolen data, often releasing sample leaks for free to advertise their “work” before auctioning the rest to the highest bidder. Unlike some cybercrime groups that focus on a single specialty—ransomware, banking trojans, or nation-state espionage—ShinyHunters thrive on versatility. They have carried out brute-force intrusions, exploited cloud misconfigurations, and, as Google’s case shows, mastered social engineering. What ties their operations together is a single goal: monetization through chaos. Their name itself comes from the Pokémon community, where “shiny hunters” are players obsessively searching for rare, alternate-colored Pokémon. It’s a fitting metaphor—ShinyHunters sift through digital landscapes looking for rare weaknesses, exploiting them, and then flaunting their finds in dark corners of the internet.

The attack on Google was as elegant as it was devastating. ShinyHunters launched what cybersecurity experts call a vishing campaign—voice phishing. An employee received a convincing phone call from someone posing as IT support. The hacker guided the target into downloading what appeared to be Salesforce’s Data Loader, a legitimate tool used by administrators. Unbeknownst to the victim, the tool had been tampered with. Once installed, it silently granted ShinyHunters remote access to Google’s Salesforce instance. Within hours, they had siphoned off contact data for countless small and medium-sized business clients. The breach didn’t expose Gmail passwords or financial records, but in today’s digital ecosystem, raw contact data can be just as dangerous. The stolen information became ammunition for phishing campaigns that soon followed—calls, texts, and emails impersonating Google staff, many of them spoofed to look as though they came from Silicon Valley’s “650” area code.

This wasn’t ShinyHunters’ first high-profile strike. They’ve stolen databases from major corporations including AT&T, Mashable, and Bonobos. They’ve been linked to leaks affecting over 70 companies worldwide, racking up billions of compromised records. What sets them apart is not sheer volume but adaptability. In the early days, ShinyHunters focused on exploiting unsecured servers and developer platforms. As defenses improved, they pivoted to supply-chain vulnerabilities and cloud applications. Now, they’ve sharpened their social engineering skills to the point where a single phone call can topple a security program worth millions. Cybersecurity researchers note that ShinyHunters thrive in the gray zone between nuisance and catastrophe. They rarely pursue the destructive paths of ransomware groups, preferring instead to quietly drain data and monetize it on dark web markets. But their growing sophistication makes them a constant wildcard in the cybercrime underworld.

Google wasn’t the only target. The same campaign has been tied to breaches at other major corporations, including luxury brands, airlines, and financial institutions. The common thread is Salesforce, the ubiquitous customer relationship management platform that underpins business operations worldwide. By compromising a Salesforce instance, attackers gain not only a list of customers but also context—relationships, communication histories, even sales leads. That’s gold for scammers who thrive on credibility. A phishing email that mentions a real company, a real client, or a recent deal is far harder to dismiss as spam. Google’s prominence simply made it the most visible victim. If a company with Google’s security apparatus can be tricked, what chance does a regional retailer or midsize manufacturer have?

At its core, the ShinyHunters breach of Google demonstrates a troubling shift in cybercrime. For years, the focus was on software vulnerabilities—buffer overflows, unpatched servers, zero-days. Today, the battlefield is human psychology. ShinyHunters didn’t exploit an obscure flaw in Salesforce. They exploited belief. An employee believed the voice on the phone was legitimate. They believed the download link was safe. They believed the Data Loader tool was what it claimed to be. And belief, it turns out, is harder to patch than software.

Google has confirmed that the incident did not expose Gmail passwords, and it has urged users to adopt stronger protections such as two-factor authentication and passkeys. But the broader lesson goes beyond patches or new login methods. ShinyHunters’ success highlights the fragility of digital trust in an era when AI can generate flawless fake voices, craft convincing emails, and automate scams at scale. Tomorrow’s vishing call may sound exactly like your boss, your colleague, or your bank representative. The line between legitimate communication and malicious deception is blurring fast. For ShinyHunters, that blurring is the business model. And for the rest of us, it’s a reminder that the next major breach may not come from a flaw in the code, but from a flaw in ourselves. And these ShinyHunters use fake Gmail accounts, which will get them caught.