Security Flaw Allowed Brute-Force Discovery of Phone Numbers Linked to Google Accounts

A cybersecurity researcher recently identified a significant privacy vulnerability that enabled attackers to determine the phone number associated with any Google account through a brute-force approach. This exploit was particularly concerning because phone numbers are highly sensitive pieces of information, often used by SIM swappers—hackers who hijack phone numbers to intercept calls and texts, thereby gaining access to a victim’s various online accounts. The researcher, known by the handle ‘brutecat,’ detailed how the attack worked: by first transferring ownership of a Google Looker Studio document to the target and then exploiting a flaw that prevented notification of the ownership change. Using custom code, brutecat was able to systematically guess the phone number linked to the target’s Google account by bombarding Google with possible combinations until the correct number was found. The process reportedly took about one hour for a U.S. number, eight minutes for a UK number, and even less for numbers from other countries. The victim would not be notified of the attack. After being alerted to the issue, Google fixed the vulnerability and acknowledged the importance of working with the security research community. The company awarded the researcher $5,000 for their findings. Although initially assessed as low-risk, Google later upgraded the vulnerability’s severity to medium. This incident highlights the ongoing risks associated with digital privacy and the importance of protecting personal information such as phone numbers, which are often used in multi-factor authentication and account recovery processes. The FBI advises against publicly sharing phone numbers due to the risk of SIM swapping and related cybercrimes.