Cyber attacks are nothing new in today’s digital world. But when the attack is on a platform that handles personal and business information of billions of people around the world, its impact is very deep. A recent cyberattack is a big example of this. Security experts say that this is one of the biggest data breaches in Google’s history, which can directly affect 2.5 billion Gmail users.
How did the attack happen?
The attack started in June 2025 and is being linked to the hacker group ShinyHunters. According to reports, this group used “social engineering” technology. This means that instead of hacking any software, they took advantage of people’s mindset and trust.
The hackers contacted a Google employee posing as IT staff and convinced him to approve a malicious application. This app was connected to Salesforce’s cloud platform. As soon as the employee said yes, the hackers got access to Google’s database and were able to extract the users’ contact details, business names and notes related to them.
Google has clarified that the passwords have not been stolen. But the data that the hackers have stolen has already started being used in different ways. Users on platforms like Reddit have reported that they are now receiving more phishing emails, fake calls and fraudulent SMS than ever before, in which information is sought by claiming to be Google staff.
What is at stake?
Even if the passwords have not been stolen directly, the information that the hackers have accessed can be very dangerous. Using contact details and business notes, they can easily call, email or message any user.
Imagine, if you get a call and the person on the other end already knows your name, email and business details, then you can easily believe it to be real. This is the danger. In such a situation, it is not very difficult to extract passwords, OTPs, or other sensitive information from users.
Some reports have also revealed that hackers are using brute-force logins. This means that they are trying common and weak passwords like “password” or “123456” again and again to gain access to an account. If this is successful, not only Gmail but also bank accounts and other online services linked to it can be at risk.
What can users do to protect themselves?
After this breach, every Gmail user should take immediate steps to increase their security. Some important measures are as follows:
- Check for data leaks—many tools like ID Protection’s Data Leak Checker will tell you if your email or information has been sold on the dark web.
- Change and strengthen the password—the new password should be unique. Create a password that is difficult to guess using letters, numbers, and special characters.
- Activate multi-factor authentication (MFA)—This will provide additional security to your account.
- Beware of suspicious emails and calls—Google never asks for passwords or OTPs over the phone or email.
- Use a passkey—Google is now promoting passkeys (such as fingerprint or face recognition). It is much more secure than passwords.
Google’s response and previous attacks
Google has started notifying affected users from August 8, 2025. The company says that most of the data was already publicly available. But security experts believe that no matter how “basic” the information is, hackers can use it to commit fraud on a very large scale.
This is not the first time Google has been the victim of a major cyberattack. There have also been incidents like the Gooligan malware campaign in 2016, OAuth-based Gmail phishing scams in 2017-18, and the Google+ API leak in 2018. It has been proven every time that hackers do not even need to steal passwords. Just a few pieces of information are enough to cause huge losses.
ShinyHunters and UNC Groups
The biggest name in this whole case is ShinyHunters. This group has already breached the systems of many companies and usually deceives the employees by posing as IT support.
Once they gain access, this group extracts millions of records using Salesforce tools like “Data Loader.”
Many times they do not sell the data immediately, but after a month another group, UNC6240, appears. This group asks for money in bitcoins from the victims and threatens that if the money is not given, the stolen data will be made public.
Security researchers believe that these groups may also start a special “data leak site” in the future, where such stolen data will be sold openly.
Conclusion
This incident once again proves that even the world’s largest tech companies are not completely safe from cybercriminals. The attack on the database of a giant company like Google testifies to the fact that users’ information is always at risk.
At present, Google has started security measures on its own, but the responsibility is not only of the company. Every user has to be cautious and use techniques like strong passwords, multi-factor authentication and passkeys.
This attack is a warning that in the digital age, our information is the most valuable asset, and we have to be more vigilant to protect it.
