Highlights:
- Hackers exploiting weak Gmail passwords in latest wave of attacks.
- Google says most users still rely on outdated password security.
- Passkeys and non-SMS two-factor authentication now critical for account safety.
- Salesforce database breach linked to phishing and scam attempts.
- Users urged to act immediately by changing passwords and upgrading security.
Google confirms passwords at risk
Google has confirmed that Gmail accounts are being targeted by hackers, with compromised passwords behind a significant number of successful intrusions. The company has warned that most users must now change their passwords to secure their accounts.
Recent reports suggest all 2.5 billion Gmail users may be at risk after a breach involving Google’s Salesforce database. Hackers are exploiting this exposure by posing as Google support staff in emails and phone calls, sometimes using AI tools to make the scams more convincing.
Google’s security recommendations
Even before this latest spate of attacks, Google had urged account holders to strengthen security by moving away from passwords alone. The company recommends:
- Adding passkeys and making them the default login option.
- Using two-factor authentication (2FA) methods other than SMS.
- Regularly updating passwords and ensuring they are unique.
Google data shows that only 36% of users regularly update their passwords, leaving the majority at risk.
How hackers exploit passwords
Most attacks involve fake sign-in pages designed to steal login credentials. Some also trick users into sharing 2FA codes or bypass 2FA entirely. Once a password is compromised, hackers can attempt to use it across multiple platforms, putting Amazon, PayPal and other accounts at risk.
Experts recommend creating strong, unique passwords stored in a standalone password manager—not one built into Chrome or other browsers.
Ongoing phishing attempts
According to PC World, although passwords were not leaked in the Salesforce breach, customer and company names were exposed, increasing the risk of phishing. Users have reported scam calls and emails from people impersonating Google staff.
On Reddit, some account holders have already described suspicious emails and spoofed error messages, highlighting new phishing methods circulating online.
How to stay secure
Google urges users to take immediate steps:
- Change your Gmail password now if you have not done so this year.
- Add a passkey and always use it as the default method of sign-in.
- Switch to an authenticator app for 2FA instead of SMS.
- Avoid signing in via emailed links—always go directly to your Google account and review activity under Security settings.
