Security Issue

This afternoon, many in the firm received an email from someone we knew inviting you to view a shared Google Document.

This was, in fact, a sophisticated phishing attack that hit Google users worldwide.  It took advantage of a security oversight in Google that allowed third parties to name a customized Google App that they created with a name that made it appear to be part of Google Docs.  If you want to read more, check out this article.

If you clicked on the link to go to the document, you were sent to what looked like a login screen which then asked to go give rights to your contacts and your Gmail account.  If you gave the app those rights, it would then send out a share to all of your contacts, inviting them to view a Google Doc that you were supposedly sharing with them.

The good news is that the App was pretty harmless.  It did not do anything beyond sending out a share notice to your contacts.  Google has also now shut down the app in question and removed any rights that you may have inadvertently given to your account.

Some people have requested password changes or that we scan your computer for malware as a result of this attack.  We are happy to change your password if you like, but there is no evidence that this attack ever got access to any passwords, nor did it ever access your computer.

Going forward, if you ever see anything asking for rights to your account, that should be a big red flag that something is wrong.  There are occasional apps that might require such rights.  For example, if you connected MS Outlook to your Gmail, it would request such rights. But if you ever have any questions about rights being given, be sure to contact the Help Desk so we can take a closer look.