Summary
- Environment: Tech
- Operational impact: Small-business contact data from a corporate Salesforce CRM instance exposed
- Financial impact: No financial figure is established by the reviewed source evidence
- Record status: Developing record. Reviewed September 19, 2026; updated as evidence emerges.
What happened
In 2025, Google experienced an incident in its tech environment. The retained source describes the attack path as follows: Voice phishing induced personnel to authorize a malicious connected OAuth application in Salesforce. [1]
The documented consequence was: Small-business contact data from a corporate Salesforce CRM instance exposed. [1]
Impact
- Documented impact: Small-business contact data from a corporate Salesforce CRM instance exposed. [1]
- No financial loss, ransom amount, recovery cost, or regulatory penalty is established by the reviewed source evidence.
Timeline
Documented public update
The The cost of a call: From voice phishing to data extortion records the incident facts used in this briefing.
[1]Briefing updated
This briefing was last reviewed and updated on September 19, 2026.
Threat Group & Attack Vector
The retained source describes the attack path as follows: Voice phishing induced personnel to authorize a malicious connected OAuth application in Salesforce. The canonical record does not add intrusion steps beyond those supported by the source. [1]
Actors
- No threat actor group has been identified in the reviewed public evidence.
TTPs
- T1566 — Phishing — mapped from the cited behavior. [1]
- T1528 — Steal Application Access Token — mapped from the cited behavior. [1]
Response
The reviewed source does not describe containment, notification, or restoration steps in enough detail to summarize them responsibly.
This account is bounded to The cost of a call: From voice phishing to data extortion. Details absent from that evidence are left unresolved rather than inferred. [1]