Google Issues Urgent Warning to Gmail Users Amid Ongoing Cyber Threats

August 31, 2025 - Google today issued an emergency security advisory to its approximately 2.5 billion Gmail users worldwide, warning them of an elevated risk of phishing and account takeover attempts following a massive breach in a third-party Salesforce system. The company urged all users to change their account passwords immediately, enable two-factor authentication (2FA), and adopt passkeys for stronger protection.

In a company blog post, Google’s Threat Intelligence Group (TAG) revealed that a hacking collective known as ShinyHunters exploited social engineering tactics-most notably “vishing,” in which attackers impersonate IT support over the phone-to gain access to sensitive business data stored in Salesforce. While Google emphasizes that no Gmail passwords or core systems were directly compromised, the stolen contact information is now being used to fuel sophisticated phishing campaigns.

Google’s advisory, sent to potentially affected users on August 8 and reiterated today, highlights a surge in “successful intrusions” facilitated by victims entering their credentials on counterfeit sign-in pages or divulging one-time codes. The company warned that ShinyHunters may soon launch a data-leak site to extort victims, escalating pressure on both individuals and organizations.

To mitigate risk, Google recommends:

  • Changing Gmail passwords to strong, unique phrases not used elsewhere.
  • Enabling two-factor authentication (also known as two-step verification) for an additional security layer.
  • Switching to passkeys-a phishing-resistant method that uses device-based authentication.
  • Running the Google Security Checkup to review connected devices, apps, and account recovery options.

“Even when core systems remain secure, exposed business contact details can be weaponized in targeted scams,” Google stated, underscoring the interconnected nature of modern security threats.

Cybersecurity experts note that while most users maintain robust passwords, only about one-third update them regularly, leaving many accounts vulnerable. With Gmail serving as the gateway to personal documents, financial services, and social media, a compromised account can have far-reaching consequences.

As part of its response, Google is accelerating the rollout of advanced phishing-resistance features and refining its AI-powered defenses to detect emerging attack vectors. In the meantime, the company reiterated that vigilance and proactive security measures remain the best line of defense for Gmail users worldwide.