Google confirmed that the ShinyHunters hacking group, also known as UNC6040, breached its Salesforce database in June. The attackers accessed basic business information through a small window before access was cut off. The group evolved its tactics, shifting from Salesforce Dataloader to custom Python scripts and using compromised accounts to register malicious applications.