Google Reveals 500 Indian Users Were Targeted By Government-Backed Hacking Attempt

Less than a month after it was uncovered that Indian journalists and activists were the targets of a WhatsApp spying attempt, Google, the world’s biggest search engine, has now admitted that hackers tried to trespass their security walls as well. Google’s Threat Analysis Group (TAG) recently revealed that between the months of July and September this year, more than 12,000 people from across 149 countries were sent warning signals, informing them that they were targets of government-backed attackers. Out of these, 500 were Indian users

Countries like in Russia, North Korea, China and Iran have been known to be involved in government-backed attacks of this nature, in which the nation-state helps cyber criminals secure better funds and access more resources in order to attack a target, usually from different countries.

While Google’s TAG was put in place to identify and combat such targeted and government-backed hacking on Google and its users, the system has acknowledged that those under highest risk include journalists, human rights activists and political campaigners, due to the fact that they hold sensitive information.

According to a blog on security settings posted by TAG, the hacking attempts from July to September were mainly phishing attacks, which is basically a way to trick the user into giving the hacker their login credentials or password. In the post, Shane Huntley from TAG explained that this was mainly done by sending an email posing as an authentic-looking Google security alert email, asking the user to update their login details or reverify their accounts, often with a link that asks them to enter their password.

Despite the two-factor verification process, the hacker can bypass security controls and access the user’s account once they enter account details on this link. He further said that there are subtle differences—such as “Google” spelled as “Goolge”—that the user tends to overlook and, therefore, should be more careful about.

“We encourage high-risk users—like journalists, human rights activists, and political campaigns—to enrol in our Advanced Protection Program (APP), which utilizes hardware security keys and provides the strongest protections available against phishing and account hijackings,” Huntley stated in the blog. “APP is designed specifically for the highest-risk accounts.”

Over a thousand government-backed phishing attacks have been reported in countries such as the US, Pakistan, Vietnam, Laos and South Korea, while countries like Canada, Saudi Arabia, Iran, Turkey, Egypt, Japan, Nigeria and Bangladesh saw around 500 or more targets.

And as more reports of our data being watched over come out, it’s become increasingly clear that no matter what we do or who we are, a security update to protect our data privacy is the need of the hour.

Follow Shamani Joshi on Instagram.