Google warned its 2.5 billion Gmail users worldwide to be on the lookout for a rise in phishing scams:
As a result, the company is advising users to update passwords and use enhanced protections.
"We believe threat actors using the 'ShinyHunters' brand may be preparing to escalate their extortion tactics by launching a data leak site (DLS)," Google said in a June blog post.
[...] The company admitted that a group of hackers breached a massive database and stored contact information for small and medium-sized businesses.
From Newsweek:
The breach involved business contact information such as company and customer names, which hackers have used to craft highly convincing phishing emails and voice-based social engineering scams.
[...] Google has not announced any timeline for further disclosures or technical updates stemming from the breach, but cybersecurity analysts expect continued attacks fueled by the leaked business data. Users are encouraged to switch from passwords to passkeys—biometric-based authentication such as fingerprints or facial recognition—which Google now recommends as the most secure option.
(Score: 5, Insightful) by mcgrew on Monday September 01 2025, @02:00PM (2 children)
I never used it, it came with some Farsebook-like G site twenty years ago. But even if I used ut, it wouldn't matter. Both the federal government and one of the credit agencies informed me that their systems had been hacked and all my private info was on the dark web.
It seems that no matter how diligent you are at security, the government, credit agencies, and corporations aren't. Your data is probably already out there whether or not you have a gmail account.
The Stupid-Ass Voter Evisceration act: SAVE Trump and his family from prison
(Score: 3, Funny) by driverless on Tuesday September 02 2025, @03:11AM (1 child)
You've misspelled Fecebook there.
(Score: 3, Informative) by Anonymous Coward on Tuesday September 02 2025, @07:29AM
I'd like to point out that in commonwealth countries it is spelled "Faecebook".
(Score: 5, Informative) by Anonymous Coward on Monday September 01 2025, @03:27PM (8 children)
Dated yesterday --
https://www.forbes.com/sites/zakdoffman/2025/08/31/entirely-false-google-says-theres-no-warning-for-gmail-users/ [forbes.com]
(Score: 5, Funny) by Deep Blue on Monday September 01 2025, @03:48PM (7 children)
Entirely false Google? Will the real evil Google please stand up, please stand up!
(Score: 2) by aafcac on Monday September 01 2025, @05:09PM (6 children)
Keep in mind that the issue is probably that it was a warning to everybody. I don't know if people that don't have 2FA set up received any sort of warning, because I thought that was the issue. But, I wasn't paying much attention as I had 2FA setup.
(Score: 2) by looorg on Monday September 01 2025, @05:20PM (3 children)
Can you even have an active Google account (mail, youtube, whatever G-product ...) without 2FA anymore? Or a secondary email account or a phone number or something else.
I abandoned my account(s) when Google demanded my phone number for "security reasons".
(Score: 3, Informative) by janrinok on Monday September 01 2025, @06:07PM (2 children)
I have a gmail account without 2FA. I just do not allow them to associate my email address with my phone number. If they have successfully achieved that without my cooperation then they have worked hard for it. The are in different names and never mention one on the other. They each have a different way of connecting to the internet
(Score: 2) by aafcac on Tuesday September 02 2025, @05:28AM
Why no 2FA? These days there's a bunch of options, some of which don't require giving them a phone number or a different email account. The only things that I use that don't play well with 2FA just get their own password.
(Score: 0) by Anonymous Coward on Tuesday September 02 2025, @07:32AM
I had one, they refused to let me access it without providing a phone number for 2FA. No other options.
I have a proton mail account now.
(Score: 0) by Anonymous Coward on Monday September 01 2025, @10:28PM (1 child)
> Keep in mind that the issue is probably that it was a warning to everybody.
I think the other way--no warning was sent to any Gmail users. It sounds more like someone started a rumor to make Gmail look bad.
I don't have 2fa set up and have not heard anything from Gmail or Google (including in the spam folder) in recent weeks.
(Score: 3, Interesting) by anubi on Tuesday September 02 2025, @01:18AM
Will people who got this notification please screenshot it and post to social media networks?
The correlation between many socially separate people should confirm this.
"Prove all things; hold fast that which is good." [KJV: I Thessalonians 5:21]
(Score: 5, Insightful) by Mojibake Tengu on Monday September 01 2025, @07:16PM (2 children)
Any kind of webmail is vulnerable technology by design, because it breaches logical separation of email transfer and web transfer.
Email data is originally fixed, static. As an effect of combining, webmail data content becomes un-fixed (fluid) at the presentation layer, and so cannot represent trustable information anymore.
Generally, combining transfer protocols with different fixation properties into one is a very bad idea.
In case of webmail contraption, constructing an unfix operator for originally trusted data is so trivial I would not even consider this an attack.
It's pure design flaw.
The kinder you are, the easier it is for wicked people to morally coerce you.
(Score: 4, Informative) by jb on Tuesday September 02 2025, @05:05AM (1 child)
The flaw isn't web mail per se, it's with the combination of web mail with HTML mail, exacerbated even further by most "large scale" web mail systems demanding javascript for no defensible reason.
A web-based MUA can, at least in theory, be just as safe as a thick client MUA, so long as it renders all messages as plain text (with attachments only available to download, not to view) and so long as it works without the browser supporting javascript (nor any other suicidal code-embedded-in-data nonsense).
(Score: 2, Interesting) by Anonymous Coward on Tuesday September 02 2025, @05:24AM
> A web-based MUA can, at least in theory, be just as safe....
Early Gmail had a version that might have been close to what you describe? It was called "for slow connections" or something like that. It worked fairly well on the final generation of dial-up modems (our neighborhood was late in getting fiber and cable internet), so it couldn't have been sending too much data.