In September 2025, the cybersecurity world was shaken by alarming headlines: hackers issued a direct ultimatum to Google, demanding the dismissal of two employees or threatening to release private records. This development didn’t come out of nowhere—it followed a massive data breach involving Google’s third-party provider Salesforce.
What makes this story unique is not just the size of the breach, which affected 2.5 billion Gmail users, but the unusual hacker demand that Google fire specific security experts. While big tech companies are no strangers to cyberattacks, the public ultimatum to target employees represents a disturbing escalation in hacker tactics.
This blog will break down the situation:
- How the Salesforce breach unfolded.
- Who the hacker groups behind the threats are.
- What the ultimatum really means for Google.
- Why this is such a critical issue for users.
- The broader lessons on cybersecurity for individuals and businesses.
The Salesforce Breach That Sparked the Crisis
Google’s troubles began in August 2025 when ShinyHunters, a notorious hacking group also tracked as UNC6040, infiltrated Salesforce databases linked to Google.
How Did the Hack Happen?
The attack wasn’t a brute-force server hack. Instead, hackers used social engineering, posing as IT support staff to trick Salesforce employees. They deployed malware and gained access to sensitive contact databases.
What Data Was Stolen?
While no passwords, financial records, or deeply sensitive personal details were exposed, the hackers managed to access:
- Business contact names
- Company information
- Email addresses
That may sound harmless, but here’s the catch: with billions of email addresses exposed, phishing and impersonation scams are now easier than ever.
Scale of the Breach
Reports estimate that 2.5 billion Gmail users are now affected. Google confirmed that this breach could accelerate the number of account hijacks, with some analysts warning that phishing scams already make up 37% of security incidents across Google’s platforms.
The Hackers’ Ultimatum
Shortly after the Salesforce breach came to light, a separate hacker collective calling itself Scattered LapSus Hunters made a bold move: they issued a public ultimatum to Google.
Their Demands
The group published their message on Telegram, demanding:
- Google must fire two employees, identified as Austin Larsen and Charles Carmakal, who are part of the Threat Intelligence teams.
- Google must immediately stop network probes by its security team.
The hackers claimed that if Google ignored them, they would leak “internal records” in retaliation.
Why Target Employees?
This is unusual because hackers typically demand money or concessions, not corporate personnel changes. Experts believe this could be:
- A personal grudge against the two security analysts.
- An attempt to intimidate security researchers, discouraging them from investigating hacker networks.
- A bluff to create chaos, since no verified evidence has been shared that the hackers possess internal Google data.
Google’s Response So Far
Google has not confirmed any compromise beyond the Salesforce breach. The company continues to focus on user security, issuing advisories on how to protect accounts. Crucially, there has been no indication that Google will comply with the hackers’ demands.
Who Are the Groups Involved?
To understand the seriousness of the situation, let’s look at the groups behind it.
1. ShinyHunters (UNC6040)
- Known for large-scale data leaks from companies like Tokopedia, Wattpad, and Microsoft in past years.
- Specialize in credential theft and selling stolen data on the dark web.
- Their role was primarily in the Salesforce breach that exposed Gmail user contacts.
2. Scattered LapSus Hunters
- A newer group, seemingly inspired by the infamous Lapsus$ collective, which was active around 2022–23.
- Known for issuing politically motivated or retaliatory threats rather than direct financial extortion.
- In this case, their ultimatum to fire employees is highly unorthodox, raising questions about their real motives.
Why This Ultimatum Matters
This is not “just another breach.” The hacker ultimatum has broader implications.
1. Escalation in Hacker Tactics
Hackers are no longer only stealing data for money. They are now trying to influence corporate decisions, putting pressure on companies in public and personal ways.
2. Increased User Risk
While hackers play their games, ordinary users face real dangers:
- Phishing emails disguised as Google support.
- Vishing scams (voice calls pretending to be IT staff).
- Credential stuffing attacks if users recycle passwords across platforms.
3. Reputation Damage for Google
Even if sensitive data wasn’t leaked, the optics are damaging. Google faces questions like:
- Can users trust Gmail security after a 2.5 billion account exposure?
- Will Google’s refusal to bow to hackers escalate into new leaks?
4. Corporate Security Governance
The demand to fire employees highlights a chilling possibility: hackers might start targeting individuals directly, hoping to weaken company defenses by creating fear.
Timeline of Events
Here’s a simplified timeline of how things unfolded:
- August 2025 – ShinyHunters breach Salesforce databases tied to Google.
- Late August – Reports confirm 2.5 billion Gmail users affected (mostly contact details).
- August 29 – Google issues a security warning urging password updates and adoption of passkeys.
- Early September – Scattered LapSus Hunters issue an ultimatum to Google via Telegram.
- September 2 onward – Speculation mounts over whether hackers truly hold internal data and what Google’s next move will be.
What Google Has Done So Far
Google has not given in to the hackers but instead doubled down on security efforts.
Key Actions Taken:
- Security Alerts – Sent warnings to billions of users about potential phishing risks.
- Promoted Passkeys – Encouraging a move beyond passwords, using cryptographic login methods to block phishing.
- Incident Response Teams – Actively monitoring any evidence of follow-up breaches.
- No Compliance with Hackers – Google has ignored demands to fire staff or halt probes.
What This Means for Users
For everyday users, the Salesforce breach may feel distant, but it has real implications.
Risks to Be Aware Of
- Phishing scams using your email and company details to look more convincing.
- Impersonation attacks, such as fake IT support calls.
- Data correlation, where attackers link your Gmail with other leaks for targeted fraud.
How Users Can Protect Themselves
- Change Passwords Immediately – Especially if you use the same password on multiple accounts.
- Enable Two-Factor Authentication (2FA) – Preferably via an authenticator app, not SMS.
- Adopt Passkeys – Google’s recommended method, which is phishing-resistant.
- Beware of Suspicious Emails or Calls – Especially those pretending to be Google support.
- Monitor Your Accounts – Watch for unusual activity in Gmail or linked services.
The Bigger Picture: Lessons for Cybersecurity
This incident reveals deeper truths about the evolving cybersecurity landscape.
1. Social Engineering Is Still the Weak Link
The Salesforce breach wasn’t about breaking encryption—it was about tricking people. This shows that human error remains the biggest vulnerability in cybersecurity.
2. Hackers Are Shifting From Money to Influence
The ultimatum isn’t about ransom. It’s about targeting individuals and trying to disrupt corporate operations. This could be the start of a dangerous new trend.
3. Third-Party Risks Are Real
Even Google wasn’t breached directly—it was a third-party vendor (Salesforce) that opened the door. Companies must pay attention to the entire supply chain, not just their own systems.
4. User Education Is Crucial
With billions at risk, user awareness is the first line of defense. Phishing only works if people click. Stronger education on scams and password hygiene is critical.
Conclusion
The ultimatum issued to Google by hackers marks a chilling new chapter in cybercrime. What began as a Salesforce breach exposing 2.5 billion Gmail contacts has escalated into a bold demand for employee dismissals. While Google has so far refused to bend, the incident highlights the growing complexity of threats in today’s digital age.
For businesses, the lesson is clear: even tech giants are vulnerable when third-party vendors are compromised. For users, vigilance is key—protecting accounts with strong authentication and being alert to scams has never been more important.
As the situation unfolds, one thing is certain: the battle between corporations and hacker groups is no longer fought only in hidden corners of the dark web. It is playing out in public, with billions of users caught in the crossfire.
