Google Issues Worldwide Gmail Data Breach Warning

[BumRushDaShow]

Source: Newsweek

Published Aug 31, 2025 at 5:53 AM EDT


Google has issued a global security alert advising its 2.5 billion Gmail users to update their passwords following a data breach involving one of its Salesforce databases. Though consumer Gmail and Cloud accounts were not directly compromised, the incident has triggered an aggressive wave of phishing and impersonation attacks targeting users across the platform. Newsweek contacted Google for more information via email outside of normal working hours.

Why It Matters

While the exposed database did not contain passwords or sensitive consumer data, the stolen business contact details have been used in a wave of phishing campaigns that mimic legitimate communications from Google. According to Google's threat research team, phishing and "vishing"—voice phishing via phone calls—now account for 37 percent of successful account takeovers across Google platforms.

What To Know

The breach involved business contact information such as company and customer names, which hackers have used to craft highly convincing phishing emails and voice-based social engineering scams. The attacker group behind the breach, identified as ShinyHunters, gained access by impersonating an IT help desk to a Google employee, ultimately deploying malware to extract the database contents, according to blog post by the tech giant dated August 5.

The breach, which was disclosed publicly the same day, originated from a Salesforce database used internally by Google to manage potential advertisers.

Read more: https://www.newsweek.com/google-gmail-data-breach-warning-2122287

[NJCher]

1. be sure you schedule at least an hour for this task

fyi

they don't make it easy.

[marybourg]

2. Took me 6 or 7 seconds, with confirmation

(and I’m in my eighties).

[NJCher]

8. did you change all the affiliated passwords

and record them?

[marybourg]

11. I only had two and they said they were changed.

[NJCher]

14. there are several sections

In just one I have 37 passwords to change..

[marybourg]

16. Wow. I don't think I have 37 passwords in my entire

on line life. No wonder it took you so long!

[NJCher]

18. I haven't done it

I probably won't; it's too much work.
Besides, see the posts below about the dubious nature of it in the first place. (posts 7 & 9)

[marybourg]

20. OK.

[Martin68]

13. I'm not sure I understand what you are trying to say. It took me 30 seconds to change my password.

[NJCher]

15. see my post above

eom

[Martin68]

23. See Beingus 81 post below.

Google asked me if I wanted to change all my related passwords as well, and I agreed. That took about 5 seconds.

[NJCher]

24. are you speaking of the

37 affiliated passwords I mentioned?

You had to have used the same password to do it in 5 seconds, right?

Not sure I feel comfortable doing that.

[Eugene]

3. :groan: 😩

thanks for posting

Oh joy! Changing several passwords across several devices.

[Bengus81]

10. One of my Gmail accounts is tied to my phone. They asked permission to change that one at the same time.

I did all four of mine plus the cell phone in 30-40 seconds.

[NJCher]

17. the other devices

I have 2 other iPads, one other laptop, and an iPhone. Tell me all about how this is going to go smoothly and I can do it in 30 seconds. LOL.

Then the password change has to be done in my passwords file.

[reACTIONary]

4. How does changing your password help guard....

.... against a sophisticated phishing attack. It might help AFTER being phished, but not before. And it might not really help after either.

This sounds like security theater to me. They wanted to tell folks to do something to make them feel safer and to seem to be a responsible company. But I don't understand what good it does other than maybe some positive PR.

[BumRushDaShow]

5. I expect they don't want to be sued for doing nothing.

[SarcasticSatyr]

6. If they didn't get any passwords, why do they want you to change your password?

It wouldn't affect the phishing attempts. If you get an email from Gmail don't click on any links . . . .

[BLewis]

7. This is NOT TRUE

Last edited Mon Sep 1, 2025, 04:32 PM - Edit history (1)

Google did not issue any warning!

Newsweek is sloppily reporting what Forbes sloppily reported. There was no 'warning' from Google because is was not Workspace (Gmail) account compromised but rather customer data (including those with Workspace accounts) from a CRM system.

THERE WAS NO WARNING from Google.

update: Keyword blog: ... claims surfaced recently that incorrectly stated that we issued a broad warning to all Gmail users...

[BumRushDaShow]

9. The Forbes article pointed to other sources including PC World

and ALL of them give the caveats and point out that there has been a ramp up of phising , etc., and it's right there in the first paragraph of the excerpt.

From PC World (that Forbes linked to) -

2.5 billion Gmail users endangered after Google database hack


Updated on August 27th, 2025: According to a statement we’ve received from Google, the leaked data and the phishing attacks are two different incidents that should be considered separately. The data breach only involved “a limited set of basic business contact information used to communicate with potential advertisers.” The phishing attacks on private users are said to be unrelated. However, users should still take the warning about potential phishing attacks seriously.

Original story from August 18th, 2025: If you’re a Gmail user, you need to be particularly careful right now as criminals are currently targeting Gmail accounts. Hackers from a group called ShinyHunters were recently able to gain access to Google’s Salesforce database systems, reports Forbes.

Google has confirmed the attacks and states that general data like customer and company names were leaked, but not passwords. The resulting data leak means that users of Google services—including Gmail and Google Cloud—are now at risk of falling victim to phishing attempts.

(snip)

RIF. Reading is Fundamental.

[Martin68]

12. Thanks for posting. Just changed my password. Whatever the situation, changing a password can't hurt.

Good practice to change it one in a while anyway.

[intrepidity]

19. If passwords weren't revealed

then why change them?

[BumRushDaShow]

22. It's possible that any other data on you that may have been revealed (e.g., "profile info" )

can be linked to pieces of other info on you that is circulating on the dark web, for other sites that may have been hacked that you belonged to, and that may have had the same password (i.e., many people, often out of just plain old necessity, use the same password across many of their sites).

[cstanleytech]

21. Anyone that hacks my bank account is more likely to transfer money into it with a sympathy message attached.