I found in my Google admin logs that someone from outside my organization is trying to log in frequently by testing all our user accounts against weak passwords. I'm wondering how could that happen?
How did he manage to get the correct list of all our users' accounts? How can he attack Google servers and verify our accounts only. Is it our domain problem? It doesn't make sense to me the attacker didn't even log in to any of the user's computers or took any passwords. Can anyone explain what is going on?