Google Gmail data breach warning: Google say they did not issue emergency warning for all email users due to growing cyber threat

At the weekend, we brought you the story that Google had issued a warning to everyone who uses Gmail because of a concern about a cyber attack.

The apparent threat was thought to be linked to a major third-party breach. Staff at the tech giant had allegedly noticed new cyberattacks, leading to the warning to be issued. But, now the tech giant has said this entirely false.

They issused a statement yesterday, (Monday September 1), which read: “We want to reassure our users that Gmail’s protections are strong and effective. Several inaccurate claims surfaced recently that incorrectly stated that we issued a broad warning to all Gmail users about a major Gmail security issue. This is entirely false.

“While it’s always the case that phishers are looking for ways to infiltrate inboxes, our protections continue to block more than 99.9% of phishing and malware attempts from reaching users.

“Security is such an important item for all companies, all customers, all users — we take this work incredibly seriously. Our teams invest heavily, innovate constantly, and communicate clearly about the risks and protections we have in place. It’s crucial that conversation in this space is accurate and factual.”

Gmail and Google Cloud have an estimated 2.5 billion users worldwide, and the company stll urging all users to remain vigilant, monitor their accounts closely, and strengthen their security measures to reduce the risk of compromise such using password alternative like Passkeys. They have also asked users to report any phishing attacks.

According to previous reports, Google’s Threat Intelligence Group (TAG), the first signs of these attacks were detected in June, when researchers discovered that hackers were impersonating IT support staf to deceive users. By August, Google confirmed that the group had achieved several “successful intrusions” through the use of compromised passwords.

Although the stolen data was described as “basic and largely publicly available business information,” it has since been weaponised to fuel more damaging schemes. “We believe threat actors using the ‘ShinyHunters’ brand may be preparing to escalate their extortion tactics by launching a data leak site (DLS),” TAG explained in a recent blog post which is still available to read. “These new tactics are likely intended to increase pressure on victims, including those associated with the recent UNC6040 Salesforce-related data breaches.”

The method, where attackers pose as IT personnel over the phone, has proven “particularly effective in tricking employees,” Google noted, with victims largely concentrated in English-speaking branches of global corporations. All users identified as impacted by the incident were formally notified by Google via email on August 8, however.

ShinyHunters are a notorious cybercriminal group that first emerged in 2020 and took their name from the Pokémon franchise. Since then, they have been linked to a string of high-profile data breaches targeting major organisations, including Microsoft, Santander, and Ticketmaster.

They are known for stealing massive amounts of user records, login credentials, and personal data, which are often leaked or sold on underground forums. In addition to data theft, they engage in extortion by threatening to release sensitive information unless companies meet their demands.

Gmail users still are being encouraged to take proactive steps to strengthen the security on their accounts. Google advises users to regularly update their passwords and enable extra safeguards like two-factor authentication, which adds an additional layer of protection against intrusions.