Overview

• Google’s September 1 blog post states it has seen no sign of a broad intrusion into Gmail accounts despite widespread automated suspicious-activity notices.
• An early claim that up to 2.5 billion users were affected was based on online reports and has been disputed by Google and follow-up coverage.
• Google previously linked a separate Salesforce-related data exposure to actors associated with ShinyHunters and said targeted customer notifications were completed within a day.
• Current threats lean on social engineering, including vishing calls that impersonate Google support to elicit verification codes, and the company reiterates it does not call users to reset passwords.
• Google says over 99.9% of phishing and malware attempts are blocked automatically and urges passkeys or two-factor authentication, noting a sharp rise in password-theft attempts and low rates of routine password changes.