Urgent: Gmail Users Face Critical Deadline After Major Security Breach

• Google warns Gmail users about account takeover attacks in which hackers change a victim’s recovery details to lock them out.
• Victims have up to seven days to use their old recovery phone or email to get back in.
• Users are advised to set up recovery options now and review their account security.
• Google offers account recovery tools for people who lose access.

Seven days to get your account back

Gmail accounts are a prize for hackers because they unlock so much else, from bank resets to cloud files. In March 2025, Google explained what happens when an attacker takes over an account and changes the recovery phone number and email to lock the real owner out. The owner gets a limited window to fight back.

How the lockout works

Once attackers have a password, often through phishing, they log in and change the account’s recovery details. That stops the owner from resetting the password the normal way. Google’s safeguard is that for up to seven days after such a change, it can still send verification codes to the previous recovery phone or email. After that window, the old details stop working.

Lock down recovery first

Set the account up so it can be recovered fast. Three steps matter most.

Add recovery options

Add a recovery phone number and a recovery email address, and turn on two-factor authentication (2FA). Without recovery options, a recovery request can take far longer.

Use a strong password

Use a long, unique password. A password manager makes that easy and avoids reuse across sites.

Check account activity

Look at the security page for recent logins and devices you do not recognize. Then sign out of anything odd.

What Google offers

Google sends alerts when recovery details change and runs an account recovery process for people who get locked out. If you get a warning about a change you did not make, act on it the same day.

Why the window matters

Account takeovers usually start with a stolen password, not a flaw in Gmail itself. The seven-day window gives victims a way back, but only if they set up recovery details before trouble starts.

Keep that recovery phone number current. An old number you no longer control is no help.

The short version

Set up recovery options today. If someone changes them without your permission, you have seven days to use the old ones and reclaim the account.

After that, recovery is much harder.

John King, CISSP, PMP, CISM

John King currently works in the greater Los Angeles area as a ISSO (Information Systems Security Officer). John has a passion for learning and developing his cyber security skills through education, hands on work, and studying for IT certifications.