Story perspectives

Google Disrupts Global Cyber Group Gallium’s Data Theft

2/25/2026

Summary

Story summary

On February 25, 2026, Google announced the disruption of UNC2814, also known as Gallium.
The group infiltrated 53 organizations across 42 countries and targeted government and telecommunications entities.
Google terminated the group’s cloud projects and disabled accounts used for data theft.
The group reportedly accessed sensitive information, including personal identification details, and a Chinese Embassy spokesperson stressed cybersecurity is global.
This activity is separate from the Salt Typhoon campaign.

1 of 1

Story summary

On February 25, 2026, Google announced the disruption of UNC2814, also known as Gallium.
The group infiltrated 53 organizations across 42 countries and targeted government and telecommunications entities.
Google terminated the group’s cloud projects and disabled accounts used for data theft.
The group reportedly accessed sensitive information, including personal identification details, and a Chinese Embassy spokesperson stressed cybersecurity is global.
This activity is separate from the Salt Typhoon campaign.