Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

This morning, I've not been able to login to my Google Account.

Google says, my account has been compromised and I had to walk through account credentials recovery and verify (SMS to verify phone number, changing password)

Now, after securing my accounts again, is there any possible investigation?

I'm interested in:

  • Type of access (now saying unknown in activity log)
  • What data has been exposed during session
  • What settings was changed, if any ...

And I'm sure, that if anybody logged into my account, he didn't used his own computer, so the IP and location from activity log is kinda unhelpful.

Is there possibility of getting these informations?
And is it good idea to take some legal steps against the hacker, or it's unnecessary and/or impossible to take action?

share|improve this question
Google is under no obligation to share this information with you. I have had this happen to me before, on an account I know for fact wasn't compromised, activity logs showed strange activity yet the activity from myself didn't match my location. One example is having mobile actvity from say NC while being in SC. – Ramhound May 16 '12 at 11:16
up vote 5 down vote accepted

The only thing you can do is take a look at the "recent activities".

You can find it in the bottom right of your GMail page, where it says something like "Last activity in this account : xx hours. Details".

Click on the details link and you'll have a list of all active current session for your GMail account. You can close them.

You'll also find a table listing the last 10 access to your account. Try to find an IP address that doesn't belong to you, it might help. (But it's just an IP, and as you may know, this can be falsified :/).

That's the only thing you can investigate for sure.

But you can see if mails has been sent (look in the Sent folder, but maybe the attacker as deleted them, so look in the Trash folder. But again, maybe the attacker has deleted them for good).

You cannot exactly now what kind of information has been exposed (account password or access sent in your email, information regarding your contact (email, telephone, etc), any settings that have been changed).

Now, I warmly recommend you to enable the two way authentication system from Google, in order to ensure an higher layer of security for your GMail account.

share|improve this answer
The two-way authentication will probably solve this to future. But I'm afraid, I won't get logs of suspicious activity from Google easily. That's the problem, as data in my account are business-critical and I need to know if anything leaked and what. – Marek Sebera May 16 '12 at 15:16

That would be a difficult process and the attacker might be using services like TOR or hidemyass, so the IP will not be the same as his location. Think why did the attacker choose you? How did he know your email address? Maybe you use your single account for both personal and business purposes.

I believe a person must have at least 3 email accounts:

  • 1 for Business
  • 1 for Personal Purposes
  • 1 for signing up on non-sense shit.
share|improve this answer

protected by Community Aug 21 '15 at 17:53

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.