Does anyone else get Google data archive notifications that they didn’t initiate?
It’s a creepy feeling when someone looks through all your data @ DMS
I know there’s no expectation of privacy here but Jesus that’s invasive
[Moderator removed AD group info]
this doesn’t look like the vault system that I’m aware of, nor is it the takeout process for an incident.
A cursory check shows no admin intervention to request a takeout nor a manual process; I’ll have to investigate more during the day but for the time being check your authorized device list and ensure you don’t have an unknown device present which could be an account compromise
I have 3 devices.
DMOne loaned to DMS which I was sitting at when it happened.
The iPhone in my pocket at the time not connected to DMS Wifi which wouldnt give that IP
Laptop which was turned off
All devices look good to me as expected
This was initiated from his account. This is not admin initiated. That is not how vault works. Kevin, click check activity in the email and post us a screenshot. This occurred from a computer you are logged in to.
The first sentence of the second screen shot says you requested it.
If you didn’t Is it possible you were logged into a public machine like a design computer or something and someone may have accessed your account? The email was at 2:30 in the morning so we could check the cameras if that’s the case.
It’s also possible to be some sort of phishing scam and wasn’t sent from Google at all. I’ve gotten “your order is complete” type emails NOT from Amazon pretending to be from Amazon. Perhaps something similar is going on here? Raise some FUD within a faked email, then prompt a click to a malware site from that email?
Oh HELL no… Do NOT click on links in that email. If the email is a phish or spam then it could contain malicious links. Always go to the web site and to the page directly or by doing a Google search - don’t go clicking links in random emails.
Raymond
(I make a living in email security.)
It’s a legit Google email…
The first thing we checked is that it was a legitimate email; we can see this with the mail routing and source information; since google DKIM signs their emails this is a safe assumption to follow.
Have you set up an archive schedule in google? Check your setting to make sure you did not set up a recurring data archive. There are posts online of people getting this email only to remember they had set up the schedule feature and forgotten about it until receiving the notification email.
