3 ms·
2.5B Gmail users endangered after Google database hack
- roscas 1y agoSo many hacks before that had name, address, phone, ss number, had it all and people don't blink an eye. Until it happens to them.
- lokar 1y agoI remember hearing that Google forced its insurance provider to make up new IDs for employees rather then use SSN, which was common at the time.
- phendrenad2 1y agoI get the sense that there was a time when Google would have not have trusted an off-the-shelf solution like Salesforce, and would have built their own in-house thing.
- exabrial 1y agoDon't worry I still get advertisements I can't unsubscribe from with one click from silicon valley bros.
- javier2 1y agoNow they can train ad bots on your emails too!
- wslh 1y agoIsn't this huge from Google's security perspective? I don't recall any previous successful attack on its core infrastructure. A quick search/prompt shows: - Operation Aurora: <https://en.wikipedia.org/wiki/Operation_Aurora https://en.wikipedia.org/wiki/Operation_Aurora> - 2010s global surveillance disclosures: <https://en.wikipedia.org/wiki/2010s_global_surveillance_disclosures https://en.wikipedia.org/wiki/2010s_global_surveillance_disc...>
- decimalenough 1y agoThe hack was on a Salesforce instance owned and operated by Salesforce but used by Google, not Google core infra.
- lern_too_spel 1y agoThe headline looks incorrect. This looks like a blogspam of a blogspam of the original Salesforce database hack reported a while ago, where Google Cloud customers had their company name and contact information stolen. This information is useful for phishing attacks on those Google Cloud customers. Free Gmail users wouldn't be in that database.
- nullc 1y ago> Activate Google’s Advanced Protection Program I'm dubious. This requires you give google a phone number. Almost universally if you give a company a phone number there is eventually an avenue for an attacker to convince the company to give them control of the account by demonstrating control of the number (which they've sim swapped or otherwise hijacked). Even if at the moment there is no avenue to exploit google this way (also doubtful), all it takes is some new product (like workspaces) that has a different security understanding or new bugs to open a vector.
- thrill 1y agoA phone number is optional if you give a recovery email. Create an iCloud account you don't use for any other reason and don't share it with anyone.
- nullc 1y agoNope. Doesn't work. Insists on adding a recovery phone number.
- Citizen8396 1y agoWhat if you enroll two security keys?
- nh2 1y agoDuplicate of event from August 5 ("one of Google’s corporate Salesforce instances was impacted"): https://news.ycombinator.com/item?id=44812343 https://news.ycombinator.com/item?id=44812343 https://cloud.google.com/blog/topics/threat-intelligence/voice-phishing-data-extortion https://cloud.google.com/blog/topics/threat-intelligence/voi...
- miohtama 1y agoSalesforce did not have user data, so the title is bogus
- decimalenough 1y agoCan we fix the title? This was a hack of a Salesforce instance used by Google, not Google itself.
- devrand 1y agoThis article links to a Forbes article that states it was a leak of a Saleforce instance that contained contact information about small and medium businesses. This PCWorld article seems to be taking that to mean that every single gmail account (2.5B) is at risk with nothing to support that claim.