If you use Google Groups, you should check your privacy settings immediately and make sure that no personal information is being leaked.
This message comes from Kenna Security, which found that nearly a third of the 9,600 public Google Groups leaked personal email sent through the platform.
The security firm discovered that such public groups belong to many important websites, including companies, hospitals, universities, newspapers, and even US government organizations.
The post says that a misconfiguration results in the leakage of emails containing invoices, passwords, and other credentials—in short, things you don't want to share online.
Why are emails leaking from my Google Group?
According to the company, Google Groups has “complex terminology” and there is a conflict between “permissions at the organization level and at the level of specific groups,” which results in list administrators “unintentionally exposing the contents of the email list.”.
Apparently, when a G-Suite administrator creates a Groups mailing list for specific recipients, they also provide a web interface for the list, at https://groups.google.com.
Privacy settings for each Google Group can be adjusted on either a domain or per-group basis, and the incorrect setting occurs when Groups Visibility is set to “Public on the Internet”.
How will you check if you have been affected?
You can visit the settings page by logging into G Suite as an administrator and typing “Settings for Groups for Business” or using this link. Here, the settings should always be set to “Private” if the group is intended to be internal to a company.
How do I configure Google Group settings?
Kenna Security notified Google of this leak, and in response, Google has issued guidance on how to adjust settings to ensure the privacy of a Group. You can make the suggested changes to prevent emails from being published.
