Don't know what the news says, but today morning I got a call from a "James Wilson" claiming to be from Google. He knew my email address (and phone number obviously) and told me that someone was attempting to change my phone number. He wanted to do a security authorization or something where I guess I would have been asked to divulge more information about my account.
When I asked him to prove he was from Google, he didn't seem fazed at all and said he would send me an email from a google.com email to prove it, and gave me his name and "employee ID". We kept talking and he said the email should show up and it was sent from his side, but the email never came. I then said I'd call google support and ask to speak with him instead - he was still unfazed. I did call Google support (im on Google One for Gemini access so luckily I actually have access to a phone number I can call), and they said it was likely a phishing attempt. I did suspect scam from the start, but it did seem a tad more professional and polished than the usual scams - the person really sounded professional, good voice quality, there wasn't a whole lot of noise in the background, they weren't fazed by my attempts at verification and just tried to dodge them hoping I wouldn't notice instead, they didn't try any pressure/urgency tactics like scammers often do.
So this news is real.. as far as I can tell they were able to connect my email address to my phone number via a leak from Google. They were trying to escalate that into further access.
I was able to break through the scam veneer on one of these calls. It was remarkably professional up until I outright called him out and told him how I knew it was a scam (the email "from Google" didn't have the right headers, he missed a bit of the terminology, didn't recognize a term, and the caller ID number was listed as being used for this scam).
I asked where he got my information, and he claimed he pulled it from Github and cross-referenced it with a large public dump.
I checked and I have a year+ ago, I just thought the timing is pretty coincidental to be the same day Google posts this. The recent breach is real, and oddly the scammers have an incentive to spread the news further because it actually supports their story when calling a victim.
I think it’s a lot likelier that some other company which has both your phone and email was breached, and conveniently the domain in your email tells them who you use as your email provider, which they can then pose as.
I was also confused. Thinking that it was a rumor, like the usual dump of credentials found in internet.
But no, Google had a major leak due to a lack of security on their side. And I have a strong suspicion that they released conflicting info over the past week in order to be fuzzy enough to defuse the blame. The "nothing to see there" while at the same time covering their ass by being able to say that they were transparent about it.
There was also an official post in Google blog about that, that conveniently is not easy anymore to find un Google search despite using all the right keywords...
So Google is using Salesforce to manage their Google ad leads and the database of their salesforces instances was breached. And despite the database not holding the passwords or credentials to your account, they have all the details about you, and your interactions with Google if you ever interacted with google ads. Like a few million persons.
And using that, it looks like hackers were able to craft more convincing than real emails looking like coming from Google, to scam people and still their credentials this time.
Rumor-mongering is primarily what the Chinese PLC and other state apparatus on their side does these days; at least much of the public facing after-math, its called irregular warfare or 5GW.
While I'm not familiar with the specific of this particular incident the fact I mention must always be considered.They are quite good at what they do.
For a bit of background checkout the Mandiant ORB Networks talk.
No, random unsubstantiated conspiracy theories must not "always be considered". Especially when, per your own admission, you don't know any of the details
Completely useless corporate speech. The whole text contains zero more information than the headline. I would have expected at least some information what are the false claims.
> Several inaccurate claims surfaced recently that incorrectly stated that we issued a broad warning to all Gmail users about a major Gmail security issue. This is entirely false.
>While it’s always the case that phishers are looking for ways to infiltrate inboxes, our protections continue to block more than 99.9% of phishing and malware attempts from reaching users.
Let's see, things that bypass the filters:
1. Using <yourgmailaddressfirstpart>@google.com which causes a mail delivery error bot bounce to @gmail.com with the spam/malware content
2. Using thousands of bot created gmail.com accounts because the gmail domain has immediate reputation within gmail
Don't know what the news says, but today morning I got a call from a "James Wilson" claiming to be from Google. He knew my email address (and phone number obviously) and told me that someone was attempting to change my phone number. He wanted to do a security authorization or something where I guess I would have been asked to divulge more information about my account.
When I asked him to prove he was from Google, he didn't seem fazed at all and said he would send me an email from a google.com email to prove it, and gave me his name and "employee ID". We kept talking and he said the email should show up and it was sent from his side, but the email never came. I then said I'd call google support and ask to speak with him instead - he was still unfazed. I did call Google support (im on Google One for Gemini access so luckily I actually have access to a phone number I can call), and they said it was likely a phishing attempt. I did suspect scam from the start, but it did seem a tad more professional and polished than the usual scams - the person really sounded professional, good voice quality, there wasn't a whole lot of noise in the background, they weren't fazed by my attempts at verification and just tried to dodge them hoping I wouldn't notice instead, they didn't try any pressure/urgency tactics like scammers often do.
So this news is real.. as far as I can tell they were able to connect my email address to my phone number via a leak from Google. They were trying to escalate that into further access.
I was able to break through the scam veneer on one of these calls. It was remarkably professional up until I outright called him out and told him how I knew it was a scam (the email "from Google" didn't have the right headers, he missed a bit of the terminology, didn't recognize a term, and the caller ID number was listed as being used for this scam).
I asked where he got my information, and he claimed he pulled it from Github and cross-referenced it with a large public dump.
You’ve never hit a breach from https://haveibeenpwned.com before that included your email and phone number?
I checked and I have a year+ ago, I just thought the timing is pretty coincidental to be the same day Google posts this. The recent breach is real, and oddly the scammers have an incentive to spread the news further because it actually supports their story when calling a victim.
I think it’s a lot likelier that some other company which has both your phone and email was breached, and conveniently the domain in your email tells them who you use as your email provider, which they can then pose as.
It's wild how quickly this rumor spread across major news sources, and yet I was unable to find a primary source at all. I wonder how this started.
I was also confused. Thinking that it was a rumor, like the usual dump of credentials found in internet.
But no, Google had a major leak due to a lack of security on their side. And I have a strong suspicion that they released conflicting info over the past week in order to be fuzzy enough to defuse the blame. The "nothing to see there" while at the same time covering their ass by being able to say that they were transparent about it.
Here is a summary about what happened: https://news.trendmicro.com/2025/08/26/google-data-breach-gm...
There was also an official post in Google blog about that, that conveniently is not easy anymore to find un Google search despite using all the right keywords...
So Google is using Salesforce to manage their Google ad leads and the database of their salesforces instances was breached. And despite the database not holding the passwords or credentials to your account, they have all the details about you, and your interactions with Google if you ever interacted with google ads. Like a few million persons.
And using that, it looks like hackers were able to craft more convincing than real emails looking like coming from Google, to scam people and still their credentials this time.
Rumor-mongering is primarily what the Chinese PLC and other state apparatus on their side does these days; at least much of the public facing after-math, its called irregular warfare or 5GW.
While I'm not familiar with the specific of this particular incident the fact I mention must always be considered.They are quite good at what they do.
For a bit of background checkout the Mandiant ORB Networks talk.
No, random unsubstantiated conspiracy theories must not "always be considered". Especially when, per your own admission, you don't know any of the details
[flagged]
If China is trying to take down Google and it's working, I say good.
Completely useless corporate speech. The whole text contains zero more information than the headline. I would have expected at least some information what are the false claims.
> Several inaccurate claims surfaced recently that incorrectly stated that we issued a broad warning to all Gmail users about a major Gmail security issue. This is entirely false.
> Several inaccurate claims surfaced recently
>> So did some accurate claims, but we won't talk about those.
> we issued a broad warning to all Gmail users
>> we issued a narrow warning to some Gmail users
> a major Gmail security issue
>> we consider it a minor issue
> This is entirely false.
>> So technically we're correct!
Hm, I would take big issue with "This is entirely false."
That means there is no kernel of truth.
Yep.
I'm curious, do people think I was supporting Google or something with my above comment? Should I have italicized instead of >>?
No idea, HN is pretty random.
>While it’s always the case that phishers are looking for ways to infiltrate inboxes, our protections continue to block more than 99.9% of phishing and malware attempts from reaching users.
Let's see, things that bypass the filters:
1. Using <yourgmailaddressfirstpart>@google.com which causes a mail delivery error bot bounce to @gmail.com with the spam/malware content
2. Using thousands of bot created gmail.com accounts because the gmail domain has immediate reputation within gmail