Google Issues Urgent Gmail Security Warning Amid ShinyHunters Fallout

August 30, 2025 - MOUNTAIN VIEW, Calif. - Google today issued an urgent alert to its 2.5 billion Gmail users worldwide, warning that stolen business data from a June breach of a Salesforce database is fueling a surge in sophisticated phishing and vishing attacks.

According to Google’s Threat Intelligence Group (GTIG), the hacker collective known as ShinyHunters has repurposed “basic and largely publicly available” business information to craft highly convincing emails and phone calls that impersonate Google IT support staff, tricking users into surrendering account credentials and even two‐factor authentication codes.

The company announced that it first detected the unauthorized campaigns in June and began notifying affected users on August 8 via email. While no Gmail passwords were directly exposed in the Salesforce breach, Google stressed that scammers can now exploit released contact details and company names to orchestrate more targeted social‐engineering schemes.

In its advisory, Google strongly recommended that all Gmail users:

  • Immediately change their account passwords to strong, unique phrases not used elsewhere.
  • Enable two‐factor authentication (2FA) or two‐step verification (2SV) using an authenticator app or physical security key.
  • Review recent security activity in account settings and remove any unrecognized devices or sessions.
  • Remain vigilant for unsolicited communications claiming to be from Google, and never provide passwords or verification codes by phone or email.

Security experts warn that ShinyHunters may escalate its extortion tactics by launching a public data‐leak site to pressure victims further, as suggested by Google’s blog. Users who receive suspicious calls (often from 650-area-code numbers) or messages allegedly from Google support are advised to hang up or delete the email and access their account directly through official Google channels-not via embedded links.

This latest alert follows a string of high-profile breaches attributed to ShinyHunters, including incidents at Microsoft, Ticketmaster, and AT&T. Google continues to monitor related threats and has pledged to update users as new information becomes available.