Google Workspace compromise investigation

If money has moved, call your bank's fraud line first. Then reset the password, sign the user out of all sessions, and review recovery options and 2-Step Verification settings. Record filters and forwarding before removing them.

• Contacts receive phishing or fake invoices from a real company address
• Gmail filters that archive, delete or forward messages the user did not create
• Mail forwarding to an unknown external address, or a delegate added to the mailbox
• Sign-ins from unfamiliar locations, or Google security alerts the user ignored
• Drive files suddenly shared externally, or 'Anyone with the link' sharing on sensitive folders
• A third-party app the user does not recognize with access to Gmail or Drive

Google Workspace records administrator and user activity in log events available in the Admin console under Reporting > Audit and investigation. That tool supports filtered searches and downloads of results. On editions that include it (Google lists Enterprise Standard and Plus, Education Standard and Plus, Frontline Standard and Plus, Enterprise Essentials Plus and Cloud Identity Premium), the security investigation tool under Security > Security center > Investigation tool adds saved investigations, pivoting between attributes and the ability to act on results.

Retention is the constraint. Google's documentation lists six months for most log event data, including Gmail, Drive, admin and login events. If an account was compromised months ago, the window may already be closing, so export what exists early.

Attackers in Gmail behave much like attackers in Microsoft 365: they hide replies, forward copies of mail to themselves, and wait for a payment conversation. We check user-level filters and forwarding addresses, mail delegation, 'Send mail as' addresses, and organization-level routing and compliance rules an attacker with admin access could have added.

Each finding is tied to log events with timestamps, so the report can say when a filter was created and what it would have caught, not just that it exists now.

Whether personal or confidential information was exposed usually comes down to Drive. Drive log events show which files the compromised account viewed or downloaded and any sharing changes during the access window. We also review files owned by the account that are shared externally or with 'Anyone with the link', because exposure can pre-date the incident.

These facts feed the breach assessment. Under PIPEDA, organizations must report breaches of security safeguards that pose a real risk of significant harm to the Office of the Privacy Commissioner of Canada, notify affected individuals, and keep records of all breaches. Our report gives counsel the factual basis for that assessment.

Some attacks never need the password again: a user is tricked into authorizing an app that reads their mail or files, and the access persists after a password reset. We review third-party app grants for the affected accounts and across the organization, and the app access controls under Security > Access and data control > API controls, including whether users can authorize unconfigured third-party apps at all.

You receive a written report with the access window, how the account was compromised, actions the attacker took, data accessed, evidence sources and their limits, and recommendations. Typical hardening steps:

• Enforce 2-Step Verification, with security keys or passkeys for administrators and finance staff
• Disable automatic forwarding to external addresses where the business allows
• Restrict third-party app access to apps you have reviewed
• Tighten Drive external sharing defaults and review 'Anyone with the link' files
• Separate super administrator accounts from daily-use accounts
• Turn on alerting for suspicious logins and new forwarding rules
• Consider Google Vault retention so mail and files survive deletion