Google has issued a global security warning to its 2.5 billion Gmail users, urging them to reset passwords and enable stronger protections following what it described as a wave of “successful intrusions” by hackers.

The company said cybercriminals have been exploiting stolen credentials through phishing campaigns and impersonation scams, with many victims tricked into handing over two-factor authentication codes or logging in via fake Google pages.

The warning comes in the wake of a breach of Google’s Salesforce database, which exposed business contact information.

While Google maintains the stolen data was “basic and largely public,” it has been leveraged in more sophisticated social engineering attacks.

Security experts say the group behind the incidents is ShinyHunters, a notorious hacker collective that has previously targeted AT&T, Microsoft, Santander, Ticketmaster and Pizza Hut Australia.

The group is believed to be preparing to escalate its tactics by launching a data leak site to pressure victims.

Google first flagged the activity in June, noting that attackers were posing as IT support staff to gain access to corporate systems – a method described as “particularly effective” at duping employees in English-speaking countries.

By early August, Google confirmed multiple Gmail accounts had been compromised and notified affected users directly.

The company is now urging all account holders to:

  • Update their passwords immediately
  • Enable two-factor authentication (2FA)
  • Run Google’s Security Checkup tool
  • Treat unsolicited emails, texts or calls claiming to be from Google with extreme caution

Cybersecurity analysts warn Australians are among those at risk, with scammers increasingly targeting individuals and small businesses through convincing “vishing” (voice phishing) calls.

Google says the majority of Gmail users already employ strong, unique passwords, but only a third update them regularly – a habit that could leave millions vulnerable.