Google Docs Password Leak Shows a Costly Security Mistake

Google lawyer Halimah Delaine Prado appeared on "Fox & Friends" to explain how Google is fighting AI‑driven phishing attacks.

Passwords sometimes end up in places they should not be. People often choose convenience now and worry about security later. One firm learned this when a contractor saved login details in a Google Doc so they could reach them from several devices.

Then something happened that should make every Google Docs user check their sharing settings. A developer searching the company’s domain on Google saw a staging hostname appear in autocomplete with what looked like a password string. The team investigated and found a Google Docs link that anyone with the URL could open.

That is a harsh way to learn that a password has traveled farther than you expected. Below is how the leak happened, what Google says about Docs privacy, and simple steps you can take to protect your passwords and shared files.

New! Free live CyberGuy class: Protect Your Money from Today’s Biggest Threats

Join us Saturday, Aug. 29 at 10 a.m. ET for a free CyberGuy LIVE class that covers five easy steps to guard against AI scams, fraud, identity theft and financial hacks. Host Kurt "CyberGuy" Knutsson will show how to set bank alerts, strengthen login security, protect your phone number, freeze credit and safeguard retirement accounts from unauthorized transfers. No tech background is needed. Attendees also receive a financial protection checklist and a link to the class recording afterward.

Reserve your free spot today at CyberGuyLive.com.

WORLD PASSWORD DAY: CHECK IF YOUR PASSWORDS ARE SAFE

A computer screen shows text about a Google Docs password leak incident. (Kurt "CyberGuy" Knutsson)

The story was first reported by The Register and comes from Siim Kostabi, co‑founder of Pageloot, a company that makes QR codes for businesses. Kostabi said his firm hired an outside contractor to help with back‑end API work. The contractor had login details for the company’s staging environment, a test version of its system.

The contractor needed quick access to those details from many devices. They placed the credentials in a Google Doc and set it so anyone with the link could view it. Later, a Pageloot developer typed the company’s domain into Google Search for an unrelated issue. Autocomplete showed one of the staging hostnames followed by what looked like a password string.

The team checked and found the public Google Docs URL. The Register noted that Google Search had indexed the document and offered its content as a search suggestion. Pageloot quickly removed the contractor’s access and changed the exposed passwords. The firm also created a rule banning passwords in Google Docs, Slack, Notion or similar tools.

Before you worry that every Google Doc you own might appear in a search, note this key point. Google told CyberGuy that Docs are restricted by default. The creator decides how the file is shared.

Google’s Drive guide says "Restricted" means only people you grant access can open a file. If you choose "Anyone with the link," anyone who gets that link can open the file without signing in. Google also lists a "Public" setting, when available, that lets anyone find the file via Google Search.

Google added that a link to a publicly shared Doc can be indexed if it is posted somewhere public where a search‑engine crawler can see it. The Register says the Pageloot document eventually showed up in Google Search autocomplete, though it does not explain how Google first found the URL. The simple lesson for us is: check the sharing setting before putting any sensitive data in a cloud document.

Kostabi also described another incident involving a Pageloot customer. A mid‑size retailer found its QR codes were sending shoppers to a competitor’s website.

Kostabi said the retailer’s investigation showed a former employee’s login had never been revoked. That ex‑employee used the lingering access to redirect the retailer’s URLs. The mistake teaches a familiar lesson.

When someone no longer needs access to an account or shared file, their permission should be removed. This applies at work and at home. Maybe you once shared a financial spreadsheet with an accountant. Perhaps an old household file still lists someone who no longer needs it. Shared access is easy to forget because the file quietly stays in Google Drive.

WHAT YOUR INTERNET PROVIDER, WEBSITES AND ADVERTISERS SEE

A company discovered staging credentials stored in a Google Doc had appeared in Google Search autocomplete after the file was shared too widely. (Kurt "CyberGuy" Knutsson)

You don’t have to run a business to learn from this story. Many people use Google Docs and Drive for household info, travel plans, tax documents and other details they want across devices.

The danger appears when sensitive data lands in a file with broader access than you realize. A Google Doc can feel private because you only sent the link to one person. What truly matters is who currently has permission to open it and what the General access setting shows. This is a good time to review files you would least want a stranger to see.

A few small changes can lower the chance that an old shared file or exposed password becomes a larger security problem.

If you have passwords saved in a Google Doc right now, move them to a reputable password manager. Password managers store logins securely and sync them across your devices. They also help you create unique passwords instead of reusing the same one. Check out the best expert‑reviewed password managers of 2026 at Cyberguy.com for options and what to look for. After moving a password, delete it from the document. If others may have accessed the file, change that password too.

Start with documents that contain financial information or account details.

On a computer:

Google says changing General access to Restricted means only people you grant can open the file.

On iPhone, iPad or Android:

This setting is handy when you need to share quickly. However, anyone who gets the link can open the file without signing in. That link can be forwarded or copied to places you never expect. For sensitive documents, share directly with specific people instead.

Open the sharing settings on important files and review the list of people who still have access. If someone no longer needs it, remove them. This is especially important after finishing work with a contractor or service provider. At home, the same idea applies when you shared a document temporarily and the reason for sharing has passed.

Changing a Google Doc from broad access to Restricted helps close the door, but it cannot undo exposure that may have already happened. If a password was in a document that others could open, change it. Then check the account’s recent login or security activity for anything you do not recognize.

Two‑factor authentication adds another step when someone tries to sign in to your account. It can help protect you if a password is stolen. CyberGuy’s guide to multifactor authentication apps can help you strengthen accounts that support this extra protection.

Strong antivirus software adds another layer of protection on your computer and phone. It cannot fix a Google Doc with the wrong sharing setting, but it can detect malicious downloads, phishing attempts and other threats that may follow if criminals obtain your login info. Keep your security software updated and ensure real‑time protection stays on. See my picks for the best 2026 antivirus protection for Windows, Mac, Android and iOS at CyberGuy.com.

Identity theft protection makes sense when an exposed document contains more than a password. For example, you may want extra monitoring if someone accessed your Social Security number, financial account data or other highly sensitive personal info. Identity theft protection services can watch for signs that your data is being misused and alert you to suspicious activity tied to your identity. If only one account password was exposed, changing that password and securing the account may be enough. The level of protection you need depends on what information was actually exposed. See my tips and top picks on Best Identity Theft Protection at CyberGuy.com.

You probably have old Google Drive files you haven’t opened in months or years. Spend a few minutes checking the sharing settings on documents that contain sensitive information. You may discover an old permission you completely forgot about. For more ways to lock down cloud files, see our guide on protecting sensitive documents and controlling file access.

Google also answered a separate privacy question with CyberGuy. The company said it does not use private Workspace content, including Drive and Docs, to train its foundational AI models such as Gemini. Google’s published Workspace guidance also states Workspace data isn’t used to train or improve the underlying generative AI models that power Gemini, Search and other systems outside Workspace without permission. That issue is separate from the Pageloot story, which focused on how the document was shared and how credentials were handled.

FAKE PASSWORD‑MANAGER ALERTS COULD PUT YOUR VAULT AT RISK

Google Docs are Restricted by default, but changing sharing permissions can expose sensitive information to anyone who gets the link. (Kurt "CyberGuy" Knutsson)

What strikes me about this story is how ordinary the original decision probably felt. Someone needed a password on more than one device and chose an easy place to store it. That shortcut eventually left company credentials where Google Search autocomplete could surface them. The second incident teaches another lesson: access should have an expiration date. When someone no longer needs to open one of your files or accounts, remove them. I would also take five minutes today to look at the Google Docs you care about most. Check who can open them and look at the General access setting. You may find nothing wrong. Great. But if you uncover an old shared link or a person who should no longer have access, you will be glad you looked before someone else did.

When was the last time you checked who can still open the Google Docs and Drive files you’ve shared over the years? Let us know by writing to us at CyberGuy.com.

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Kurt "CyberGuy" Knutsson is an award‑winning tech journalist who loves technology, gear and gadgets that improve life. He contributes to Fox News & FOX Business, appearing each morning on "FOX & Friends." Got a tech question? Get Kurt’s free CyberGuy Newsletter, share your voice, a story idea or comment at CyberGuy.com.

COPYRIGHT DISCLAIMERS

4English does not own the rights to this content. All rights belong to the owner. 4English only uses this content to help users learn English via the app's features. Contact to request the removal of your content: contact@4englishapp.com.

Practice Listening