Google: Gemini breach exposed three firms; notice delayed

Google disclosed that its Gemini artificial intelligence was used to gain unauthorized access to data belonging to three corporate customers and that the company waited seven weeks before informing them. The company reported it had been investigating the incident during that period.

Google identified anomalous activity tied to Gemini operations, launched an internal investigation and notified affected customers after the seven-week interval. The company did not name the three firms or provide full technical details about how the access occurred.

The affected users were enterprise customers using Gemini-powered tools or services. Google removed the specific vectors used in the incidents, rolled out updated access controls and increased logging and monitoring to detect similar activity. The company is working with the customers to assess the scope of exposed data.

Google did not specify what types of customer data were accessed or whether the intrusions resulted from a software bug, a misconfiguration, misuse of privileged access, or a third-party compromise. The investigation is ongoing, and Google plans to provide more information as it becomes available.

The seven-week delay in notifying customers has drawn scrutiny because many jurisdictions and corporate policies require prompt disclosure of security breaches. Google said it informed customers after completing initial containment and gathering sufficient information to brief them. The company did not provide a timetable for public disclosure or regulatory notifications and stated it is cooperating with relevant authorities as required.

Independent security experts note that incidents linked to models can stem from insecure connectors to customer systems, misapplied prompts that leak data, or weak isolation between training and production environments. Google said it is reviewing notification procedures and security controls for Gemini deployments.

There were no immediate public reports of material financial loss tied to the incident. Google did not indicate whether the affected companies experienced operational disruptions or legal claims. The identities of the companies and the nature of the data accessed remain undisclosed. Google will update customers and the public as the investigation continues and remediation completes.