Mysterious Gmail account lockouts prompt hack fears

[tao]

Something happening here, what it is ain't exactly clear

 

Updated A substantial number of Gmail users have been affected by a potential but unconfirmed hack of unknown origin or purpose.

 

El Reg learnt of the issue following a tip from a self-described "very security conscious" IT professional who got locked out of his Gmail account. This happened after one of his security phone numbers was changed.

 

Apparently others have suffered somewhat similar problems and have posted their experiences to Reddit and elsewhere. Users are receiving messages saying that their account has been changed, and asking them to re-sign into Google on their mobile. It's not clear if some sort of glitch or a hack is to blame.

 

This is more a case of being bounced out of accounts than being locked out as such.

 

In response to a thread on one of its official forums, Google said it was investigating the issue while downplaying concerns.

We've gotten reports about some users being signed out of their accounts, unexpectedly. We're investigating, but not to worry: there is no indication that this is connected to any phishing or account security threats.

El Reg requested comment directly from Google on Friday morning but we're yet to hear back. While we've been waiting for a response, we've canvassed security folks through Twitter, two of whom have said they've been been asked to reauthenticate themselves and log back into their Google accounts. ®

Updated to add

Google staff, speaking to The Register, claim this week's mysterious account login hiccup is unconnected to the Cloudflare session token leak, although would not elaborate further.

 

< Here >

 

[straycat19]

I experienced this with my wife's account but other than having to reset the password I did not notice any change in any of her account settings.  Matter of fact it was no different than usual, they sent a code via text message and we used that to access her account and change the password.  I have several gmail accounts and none of them have been affected by this but then I use two factor authentication on all my accounts.  People I have talked to who use two factor authentication have not had this happen to them either.

[straycat19]

Crystal Cee said:

Thanks for your patience as we investigated this issue. Here’s what we’ve learned and what to do if you’re still experiencing issues. 

What happened?

 

During routine maintenance [from 1pm to midnight PST yesterday], a number of users were signed-out from their Google accounts. This may have resulted in you being signed out of your account or seeing a notification about “A change in your Google account” or “Account Action Required.”

 

We hear your concerns that this appeared to potentially be phishing or another type of security issue. We can assure you that the security of your account was never in danger as a result of this issue. You can always learn more about the Security tools Google provides at www.google.com/safetycenter/

 

What should I do now?
First, try signing back in with your usual username and password at accounts.google.com. If you can’t remember your password or can’t sign in for another reason, recover your account here: g.co/recover.

 

Thanks again and if you’re experiencing issues outside of what’s described here, please create a New Post for further assistance.

Best,
Crystal Cee
Gmail Community Manager

 

Source

[virge]

Change your account password often

Don't use the same password across multiple accounts.

Passwords should be a combination of uppercase, lowercase, numbers and a special character.

Don't store passwords in your browser.

Use a password manager like Roboform and an encrypted spreadsheet to keep track of your passwords.