Google is under pressure from a hacker group called Scattered LapSus Hunters, who have demanded that the tech giant fire two employees, Austin Larsen and Charles Carmakal, and halt network probes conducted by Google Threat Intelligence Group. The hackers, claiming connections to groups like Scattered Spider, LapSus, and ShinyHunters, threatened to leak Google records if their demands are not met.

The warning follows Google’s disclosure in August that ShinyHunters had accessed information from Salesforce, a third-party vendor. However, there is no evidence the hackers accessed Google’s own databases. Despite this, Google has issued a global security alert urging its 2.5 billion Gmail users to change passwords due to a surge in phishing and vishing attempts.

The hackers exploited stolen company contact data to send realistic phishing emails and make fraud calls targeting users. Google confirmed that the breach originated from social engineering, where ShinyHunters posed as IT help desk staff to steal the Salesforce database. While no private user data was leaked, this incident highlights how even indirect breaches can trigger large-scale threats and cyberattacks.