[Security](https://leakly.com/security/)

[Confirmed][Archive]

# Google’s Salesforce breach hit one instance, not Google accounts — confirmed

Google acknowledged access to business information in one Salesforce instance, not a general compromise of Google accounts.

Leaked on 05 August 2025

![Original Leakly terminal-style archive card: Google’s Salesforce breach hit one instance, not Google accounts — confirmed](https://leakly.com/assets/og/google-salesforce-breach.png)

[Google](https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion)’s disclosure of a Salesforce incident was easy to misread as a compromise of ordinary Google accounts. The company’s August 2025 update described something more specific: attackers had accessed a corporate Salesforce instance used for business contact information and related notes. [TechCrunch](https://techcrunch.com/2025/08/06/google-says-hackers-stole-its-customers-data-in-a-breach-of-its-salesforce-database/) reported the confirmation on 6 August, saying Google had updated its account late the previous day.

> **TechCrunch** @TechCrunch
>
> Google says hackers stole its customers' data in a breach of its Salesforce database | TechCrunch https://t.co/1mCAeZkir0
>
> 96 likes · 40 reposts · counts as of 09 Nov 2026, 01:46 UTC
>
> — TechCrunch (@TechCrunch) [August 6, 2025](https://twitter.com/TechCrunch/status/1953066036980338939)

not in our leaker index

The underlying intrusion happened in June. The public-disclosure date and the attack date are therefore not interchangeable. This archive uses 5 August for the disclosure it is examining, rather than making the breach look as though it began when news outlets picked it up.

Google said the retrieved material was basic, largely publicly available business information. That does not make unauthorized access harmless, but it limits what can responsibly be inferred. The company’s statement did not support a claim that Gmail accounts, everyone’s saved passwords or the whole Google platform had been exposed. TechCrunch noted that Google had not disclosed the number of affected customers.

Reporting connected the incident with a wider pattern of voice-phishing attacks against organizations using Salesforce. That is not the same as establishing a vulnerability in Salesforce’s core software. Attackers persuading people to grant access and attackers exploiting an underlying product defect are different security problems, even when the eventual stolen information sits in the same service.

The confirmed badge rests on Google’s own acknowledgment, not on a criminal group’s claim. Our sources include the company’s account and outlet reporting about the campaign. We do not reproduce contact records or direct readers to an extortion site. The public-interest issue is the boundary between a company’s main consumer services and the business systems around them: a real incident deserves precise reporting, not a larger and less accurate headline. (source: [Malwarebytes](https://www.malwarebytes.com/blog/news/2025/08/how-google-adidas-and-more-were-breached-in-a-salesforce-scam))

[Confirmed]

## What happened later

Google acknowledged access to business information in one Salesforce instance, not a general compromise of Google accounts.

## Sources

* [Original X post by @TechCrunch](https://x.com/TechCrunch/status/1953066036980338939)
* [Google — The Cost of a Call: From Voice Phishing to Data Extortion](https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion)
* [TechCrunch — Google says hackers stole its customers' data by breaching its Salesforce database](https://techcrunch.com/2025/08/06/google-says-hackers-stole-its-customers-data-in-a-breach-of-its-salesforce-database/)
* [Malwarebytes — How Google, Adidas, and more were breached in a Salesforce scam](https://www.malwarebytes.com/blog/news/2025/08/how-google-adidas-and-more-were-breached-in-a-salesforce-scam)

[Status definitions](https://leakly.com/editorial-guidelines/#status) · [Corrections](https://leakly.com/corrections/) · [Contact](https://leakly.com/contact/)