Cloud brute-force attack cracks Google users' phone numbers in minutes

A security researcher (Brutecat) disclosed a flaw in Google's account recovery and Looker Studio integration that exposed users' phone numbers to a brute‑force enumeration attack. By creating a Looker Studio document, transferring ownership to a target, leveraging a legacy username recovery form that worked without JavaScript, and running an automated tool that validated candidate numbers, the researcher could unmask phone numbers tied to email addresses and demonstrated rapid enumeration times for several country codes; Google has since patched the issue and awarded a bug bounty.