Google advices millions of Gmail users to change passwords following attack

Google is sounding the alarm for its 2.5 billion Gmail users, urging everyone to beef up their security following a surge in sophisticated scam attacks.

The warning comes after the notorious hacking group ShinyHunters successfully breached one of Google’s Salesforce databases in June. This kicked off a wave of convincing phishing attempts that are now picking up steam.

The ShinyHunters hacking group is at it again, and your inbox is in the crosshairs

Now, while Google did confirm that the June incident didn’t expose user passwords, it did leak business and customer names. This is still sensitive information and can be leveraged by attackers to make their scams feel more legitimate, which is exactly what they’ve been doing.

The technique they’ve been using to do this is called vishing or voice phishing. Gmail users happen to be a prime target. The scam often involves a phone call from someone pretending to be from Google support, typically using a 650 area code. They’ll claim your account is compromised and cleverly guide you through a password reset, only to have you hand over the new credentials, locking you out for good.

ALSO READ: 6 Gmail AI features that will get you emailing like a pro

This is a kind of social engineering attack since it’s highly personalised. Such attacks have grown frighteningly effective of late, accounting for 37 per cent of all successful account takeovers across Google’s services.

How to stay safe

The first step here to keep safe is to remember that Google will never call you unprompted about a security breach. If you get a call like this, just hang up.

Google is also advising users to change their passwords right away. You should also enable a non-SMS form of two-factor authentication. Using a passkey is your best bet for locking down your account. It is also a good idea to run Google’s Security Checkup to spot any vulnerabilities and update your recovery information.