{"id":1922,"date":"2025-09-22T15:32:54","date_gmt":"2025-09-22T21:32:54","guid":{"rendered":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/?p=1922"},"modified":"2025-10-02T21:15:31","modified_gmt":"2025-10-03T03:15:31","slug":"confederation-of-the-uncs-a-brief-look-into-a-series-of-the-salesforce-data-theft-exploit","status":"publish","type":"post","link":"https:\/\/wpsites.ucalgary.ca\/jacobson-cpsc\/2025\/09\/22\/confederation-of-the-uncs-a-brief-look-into-a-series-of-the-salesforce-data-theft-exploit\/","title":{"rendered":"Confederation of the UNCs – A Brief Look into A Series of the Salesforce Data Theft Exploit"},"content":{"rendered":"\n

CAUTION<\/strong>: This post is most-likely riddled with a prematurely conceived notion of someone who thinks they can fix cybersecurity for the defenders (we have a lot of those, don\u2019t we?<\/em>), but hear me out and approach this from the point of view of someone who genuinely wants to work with another person (and another person, and another person<\/em>) to discuss the very essence of cybersecurity, and how it could<\/em> positively affect our daily lives.<\/p>\n\n\n\n

Overview<\/strong><\/p>\n\n\n\n

As you may already know, a lot of companies; multinational and small to medium companies alike; adopt the use of Customer Relationship Management Systems (CRMs) to interact with their end users and ultimately store customer data through these systems. Salesforce is a popularly adopted tool for most of them; so one can infer that a lot of companies use Salesforce, right? Right. <\/p>\n\n\n\n

In fact, according to an August 2025 article<\/a>, Salesforce holds the largest CRM adoption in the market, for the seventh consecutive year, to a tune of 19.8% in the world, ahead of Oracle, SAP, Adobe and Microsoft. With these impressive stats, one would expect that they would be exempt from data thefts and exploits, right? Unfortunately, wrong. As we have seen so far from reading through our colleagues’ blogposts, no one is immune from being hacked.<\/p>\n\n\n\n

This post will take a really <\/em>brief look into a data theft that seems to have been targeted towards the CRM outfit of the company Salesforce and has affected several of their clients. I will also share my thoughts and recommendations based on research.<\/p>\n\n\n\n

To avoid boring you, I’ll keep my analysis to Salesforce and data privacy specifically so we don’t end up spending 20 years reading my post alone (looking forward to your comments – hopefully praising me and telling me how I would end up carrying cybersecurity on my back, and how you revere my courage to sift through millions of articles to get here<\/em> – but I digress).<\/p>\n\n\n\n

Super short Anatomy of the Breach \u2013 <\/strong>an example<\/strong><\/a> from the Google Exploit<\/strong><\/p>\n\n\n\n

\"Photo
An Anatomy tree from Unsplash<\/a> (May, 2024)<\/figcaption><\/figure>\n\n\n\n
\n

The Google breach<\/a><\/strong> became the highest-profile example of this method. In June 2025, attackers compromised a corporate Salesforce instance used to manage prospective Google Ads customer information. Attackers exposed approximately 2.55 million records, including business names, phone numbers, and sales follow-up notes. This is data with high value for phishing and fraud campaigns. Google stated that the data was largely public-facing and unrelated to Ads product systems, but the incident showed how attackers can weaponize even \u2018non-sensitive\u2019 CRM data once they exfiltrate it. GTIG confirmed the breach was part of the UNC6040\/ShinyHunters activity, with custom tools used to accelerate Salesforce data extraction.<\/p>\n<\/blockquote>\n\n\n\n

The attackers combined three core vectors:<\/p>\n\n\n\n