Google debunks claim of systemwide Gmail emergency alert

Google on Monday moved to quash viral reports that it had issued an emergency warning to some 2.5 billion Gmail users, saying the claim that it sent a broad alert about a major Gmail security flaw is entirely false. In a blog post, the company sought to reassure users that Gmail protections remain robust, that it blocks more than 99.9 percent of phishing and malware attempts, and that there was no blanket notification to the entire Gmail user base this week.

The confusion appears to have grown out of a separate incident tied to a breach of a Salesforce instance and subsequent online reporting that linked that event to Gmail account exposure. Security researchers and media outlets circulated accounts suggesting a mass warning; Google said those reports conflated earlier, targeted notifications sent to affected accounts with an all-user emergency notice. Google also noted it completed outreach to affected users on August 8 and did not issue a systemwide alert afterwards.

While Google rejected claims of a systemwide breach, it confirmed that attackers increasingly exploit third-party data to improve the success of phishing campaigns. Google’s Threat Intelligence team has attributed...