I found in my Google admin logs that someone from outside my organization is trying to log in frequently by testing all our user accounts against weak passwords. I'm wondering how could that happen?

How did he manage to get the correct list of all our users' accounts? How can he attack Google servers and verify our accounts only. Is it our domain problem? It doesn't make sense to me the attacker didn't even log in to any of the user's computers or took any passwords. Can anyone explain what is going on?

  • Try this test: attempt to log into an account that does not exist. Did the non-existent account show up in the logs? If not, then you are jumping to the wrong conclusions about "knowing the right account names".
    – schroeder
    Jun 3 at 10:17
  • @schroeder I did, its not showing as u have said, but still I didn't under stand how my admin log shows real accounts trying to log in and out, add on that last night he found an administrator temp account then spend too much time and got the password and started to change other users passwords!
    – Dreamer64
    Jun 4 at 6:37
  • 5 sec between each login, 2min for admin accounts its like a script just crawling to our all accounts trying to find admins n gain privileges
    – Dreamer64
    Jun 4 at 6:39
  • So your entire question is based on a false premise. They do not know the names of the correct accounts. They are trying random accounts and sometimes getting it right. This defeats most of your question. How can they try multiple accounts? As you say, they have a script. Anything exposed to the internet is subject to people trying to log in.
    – schroeder
    Jun 4 at 14:29
  • I’m voting to close this question because it is based on a false premise. This is just a plain ol' brute force attack on internet-facing services.
    – schroeder
    Jun 4 at 14:30

1 Answer 1


Most likely the hacker does not know which accounts are valid. They are either using a dictionary, purchased an email list or if they are professionals, created their own list.

Based upon the details in your question, we can only guess.

Tip: It is very easy to build a list of accounts and is not as hard as you think. One solution is to implement MFA on all accounts. If you have had a data breach, you will need professional help.

  • MFA already enabled, but he still trying and still I'm seeing a attempts in my log, for a breach no, only attempts to login most of them failing
    – Dreamer64
    Jun 4 at 5:28
  • For the professional help part, we have contacted local authorities and Google it self with out any use, its like we r on our own now :) (because its only attempts but no real breach) I don't want to wait till real breach to start going an lose my data !!!
    – Dreamer64
    Jun 4 at 6:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.