Google says it stored some G Suite passwords in plaintext due to an error dating back to 2005, found another set of unhashed passwords in 2019, both now fixed
Google says a small number of its enterprise customers mistakenly had their passwords stored on its systems in plaintext.
Context & Ripple Effects
This is the second time Google has disclosed a long-running Google Apps/G Suite data exposure: a bug that leaked private WHOIS data for 280K domains ran from mid-2013 until its 2015 disclosure, and the plaintext-password error stretches even further back, to 2005. The pattern was later corroborated by [[a:1155475|a leaked internal database tracking thousands of privacy and security issues from 2013 to 2018]], which detailed systemic data-management mistakes rather than isolated incidents.
The disclosure also sits awkwardly next to Google's own security marketing: the company has touted that its 85,000+ employees have had no successful phishes since moving to physical Security Keys, while its paying enterprise customers were exposed by exactly the kind of password-based risk that program was built to eliminate.
First-order effects
- A small number of G Suite enterprise customers learn their credentials sat unhashed on Google systems for up to fourteen years, forcing credential rotations and internal breach-protocol reviews at companies that bought Google Cloud precisely for its security posture.
- Google's enterprise sales teams face immediate trust questions from G Suite buyers evaluating against Microsoft's Office 365, where credential handling is a standard procurement checklist item.
Second-order effects
- The incident hands Google's own Security Key program its strongest internal business case yet — expect accelerated pressure to move G Suite customers off passwords entirely, converting a liability into a product push.
- Enterprise buyers and auditors will add legacy credential-storage practices to vendor risk assessments, raising diligence costs for all cloud productivity vendors, not just Google.
Third-order effects
- If the pattern holds — decade-old storage errors surfacing years after the fact, as the 2024 leak of Google's internal issue-tracking database suggested — regulators and enterprise customers will push for mandatory retention limits on raw credentials and faster self-audit disclosure cycles across the cloud industry.
- The longer arc points toward passwordless authentication becoming table stakes for enterprise SaaS, with incidents like this one doing more to drive adoption than any feature pitch.
The trend: Recurring disclosures of legacy credential-handling failures are pushing enterprise cloud providers to phase out password storage altogether in favor of phishing-resistant authentication.