Google Warned Gmail Users About This New Threat

Google has sounded the alarm with an emergency warning to all Gmail users, urging extra caution amid a growing cyber threat linked to a major third-party breach. While the company stresses that its own systems remain secure, the incident has opened the door for hackers to exploit stolen data in new and deceptive ways.

Here’s what you need to know and why it matters for your own inbox.

Google has issued a stark warning to Gmail users after uncovering a fresh wave of cyberattacks linked to one of the internet’s most notorious hacking groups. The threat emerged following a breach of Salesforce’s cloud platform, which left individuals and organizations using Google services more vulnerable to intrusion.

With Gmail and Google Cloud serving an estimated 2.5 billion people worldwide, the company is urging users to remain vigilant, monitor accounts closely, and strengthen their security measures to reduce the risk of compromise.

According to Google’s Threat Intelligence Group (TAG), the first signs of these attacks were detected in June, when researchers discovered that hackers were relying on social engineering tactics—specifically impersonating IT support staff—to deceive targets. By August, Google confirmed that the group had achieved several "successful intrusions" through the use of compromised passwords.

Although the stolen data was described as "basic and largely publicly available business information," it has since been weaponized to fuel more damaging schemes. "We believe threat actors using the 'ShinyHunters' brand may be preparing to escalate their extortion tactics by launching a data leak site (DLS)," TAG explained in a recent blog post. "These new tactics are likely intended to increase pressure on victims, including those associated with the recent UNC6040 Salesforce-related data breaches."

The vishing method, where attackers pose as IT personnel over the phone, has proven "particularly effective in tricking employees," Google noted, with victims largely concentrated in English-speaking branches of global corporations.

All users identified as impacted by the incident were formally notified by Google via email on 8 August 2025.