[Security](https://leakly.com/security/)

[Confirmed][Archive]

# Google’s Salesforce breach was not a compromise of everyone’s Google account

Google acknowledged access to business information in one Salesforce instance, not a general compromise of Google accounts.

Published 09 Nov 2026, 02:21 UTC

Leaked on 05 August 2025

![Original Leakly terminal-style archive card: Google’s Salesforce breach was not a compromise of everyone’s Google account](https://leakly.com/assets/og/google-salesforce-breach.png)

Google’s disclosure of a Salesforce incident was easy to misread as a compromise of ordinary Google accounts. The company’s August 2025 update described something more specific: attackers had accessed a corporate Salesforce instance used for business contact information and related notes. TechCrunch reported the confirmation on 6 August, saying Google had updated its account late the previous day.

The underlying intrusion happened in June. The public-disclosure date and the attack date are therefore not interchangeable. This archive uses 5 August for the disclosure it is examining, rather than making the breach look as though it began when news outlets picked it up.

Google said the retrieved material was basic, largely publicly available business information. That does not make unauthorized access harmless, but it limits what can responsibly be inferred. The company’s statement did not support a claim that Gmail accounts, everyone’s saved passwords or the whole Google platform had been exposed. TechCrunch noted that Google had not disclosed the number of affected customers.

Reporting connected the incident with a wider pattern of voice-phishing attacks against organizations using Salesforce. That is not the same as establishing a vulnerability in Salesforce’s core software. Attackers persuading people to grant access and attackers exploiting an underlying product defect are different security problems, even when the eventual stolen information sits in the same service.

The confirmed badge rests on Google’s own acknowledgment, not on a criminal group’s claim. Our sources include the company’s account and outlet reporting about the campaign. We do not reproduce contact records or direct readers to an extortion site. The public-interest issue is the boundary between a company’s main consumer services and the business systems around them: a real incident deserves precise reporting, not a larger and less accurate headline.

[Confirmed]

## What happened later

Google acknowledged access to business information in one Salesforce instance, not a general compromise of Google accounts.

## Sources & captured post

> **TechCrunch** @TechCrunch
>
> Google says hackers stole its customers' data in a breach of its Salesforce database | TechCrunch https://t.co/1mCAeZkir0
>
> 96 likes · 40 reposts · counts as of 09 Nov 2026, 01:46 UTC
>
> [View the post on X](https://x.com/TechCrunch/status/1953066036980338939) · not in our leaker index

### Original source & corroborating coverage

* [Original X post by @TechCrunch](https://x.com/TechCrunch/status/1953066036980338939)
* [Google — The Cost of a Call: From Voice Phishing to Data Extortion](https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion)
* [TechCrunch — Google says hackers stole its customers' data by breaching its Salesforce database](https://techcrunch.com/2025/08/06/google-says-hackers-stole-its-customers-data-in-a-breach-of-its-salesforce-database/)
* [Malwarebytes — How Google, Adidas, and more were breached in a Salesforce scam](https://www.malwarebytes.com/blog/news/2025/08/how-google-adidas-and-more-were-breached-in-a-salesforce-scam)

[Status definitions](https://leakly.com/editorial-guidelines/#status) · [Corrections](https://leakly.com/corrections/) · [Contact](https://leakly.com/contact/)