...
By Theo Burman
Live News Reporter
0
Share
Newsweek is a Trust Project member
See more of our trusted coverage when you search.Prefer Newsweek on Googleto see more of our trusted coverage when you search.
Hackers have threatened to leak Google databases unless the company fires two employees, according to a post on Telegram.
The post claiming to be from a hacking group called on the tech giant to fire the employees while also suspending Google Threat Intelligence Group investigations into the network.
Why It Matters
As one of the largest tech companies in the world, any breach that affects Google has the potential to impact millions of users, which is why the company takes cybersecurity so seriously. According to Google's internal metrics, Gmail already blocks 99.9 percent of spam, malware and phishing attempts from reaching inboxes.
Read More on News
...
What To Know
The group is claimed to be a network of hackers made up of members from other hacker communities, consisting of Scattered Spider, LapSus and ShinyHunters. The group has branded itself Scattered LapSus Hunters in reference to this.
The two employees the group called on to be fired are members of the Google Threat Intelligence Group. This is likely why the group targeted the two employees in their message.
While the group did not provide any proof that they had access to any Google databases, and there have been no recent breaches of Google information, the news comes after Google said in August that ShinyHunters gained information from Salesforce, a third-party that provides some services to Google.
The breach, which was disclosed publicly the same day, originated from a Salesforce database used internally by Google to manage potential advertisers.
The company said that "only a limited set of basic business contact information used to communicate with potential advertisers" was exposed, not personal Gmail account credentials.
"On August 28, 2025, our investigation confirmed that the actor also compromised OAuth tokens for the "Drift Email" integration," Google said, in a statement that said the breach was confined to Salesforce.
"In response to these findings and to protect our customers, Google identified the impacted users, revoked the specific OAuth tokens granted to the Drift Email application, and disabled the integration functionality between Google Workspace and Salesloft Drift pending further investigation."
What People Are Saying
Google said in a statement on the breach: "We are notifying all impacted Google Workspace administrators. To be clear, there has been no compromise of Google Workspace or Alphabet itself."
What Happens Next
Google is unlikely to respond to the demands of the group.
Update 9/3/25, 6:02 a.m. ET: This article has been updated with additional information and to remove personal details of individuals targeted.
View 0 Comments
Submit Correction
View Editorial & AI Guidelines