Organizations’ Misconfigured Google Groups Settings Leak Credentials, Data

Researchers discovered that over 9,600 organizations misconfigured their Google Groups settings, which inadvertently allowed sensitive information such as email, user names, passwords, and company financial data to become searchable to the public. Organizations include Fortune 500 companies, academic and healthcare institutions, media stations, and several United States public agencies.

Google released a GSuite blog post reminding organizations to review their permissions and configure their Google Groups settings after security researchers notified them that discussions — such as customer support transactions and sensitive internal communications — were set to public and could be searched. Some sensitive messages were reportedly revealed after loading the organizations' public Google page and using search terms such as “password,” “username,” “accounting,” and “hr.” Other searchable items include internal organization resources such as manuals, schedules, and reports of applications problems and concerns.

[Read: Securing data through network segmentation in modern enterprises]

Misconfigured shared user interfaces and cloud services some of the top causes for data leaks in the past year, and remain a concern for IT administrators. Settings left on default have led to accidentally exposed and downloadable databases, and cyberattacks such as spearphishing and BEC, among other forms of fraud. Here are a few best security practices:

• Review and configure the privacy settings of your discussion groups. Set to “private” all online forums involving internal communications and confidential processes; separate them from all public conversations open to customers.
• Practice data categorization. Limit the company personnel who can have access to classified information, as well as those who have monitoring and control on the corporate environment.