Ask HN: Non-profit school possibly hacked, locked out of Google Workspace.
Sometime between last night and this morning (US Eastern time) all the accounts in their free non-profit Google Workspace tenant (including the dedicated "admin@..." account used only for administration) began entering a "This account was recently deleted and may be recoverable. Click Next to attempt to restore this account." workflow. The "Next" page in that workflow says "Contact your domain admin for help. Learn more". The "Learn More" link takes them to a support link talking about finding out who your Administrator is and a link to a page to reset the Workspace administrator password, which just follows this same flow.
I don't use Google products personally. I have absolutely no idea where to recommend they go. I'm not finding any way to contact a human at Google in the cursory searches I've done. I keep getting funneled back to recovery workflow that ends up right back in the flow I described above.
They're reasonably freaked-out because they have no backup / offline copies of their decade-plus use of the data they've stored in the Google Workspace product. They're also reeling from the lack of access to their email.
I feel terrible for them. The best I think I can do is write this tug-at-heartstrings post and hope a kind hearted Googler / Google-adjacent person might give me some pointers.
I haven't broached the subject of moving the MX for the domain to a different service to restore email access. That's probably the next step if this can't be resolved quickly.
---
UPDATE: As people get in to their office this morning I am learning more.
One of their users was able to see a Google Workspace notification telling them "The primary admin for your organization was changed from oldadmin@domain.org to ssadmin@domain.org" this morning at 00:01 UTC.
I'm feeling like an unauthorized party may have taken control of their tenant.
---
UPDATE 2: They've initiated a request thru https://toolbox.googleapps.com/apps/recovery/form using the "new" admin account. That workflow directed them to add a CNAME to their DNS to prove domain ownership. Fortunately the person who handles their domain is an actual human small business owner who they cal talk to. Perhaps there's a light somewhere at the end of this tunnel.
I don't know anything about the password or MFA configured on their original admin account. Adjunct to all of this it would be interesting to know what happened and if some kind of security incident (likely of the end user org's own making, sadly) kicked off this whole thing.
---
Aside: Does the "Google Takeout" product work with the Workspace product? When they eventually do get access back to their data I'm advising them to make backup copies of everything they can regularly.
Interestingly the admin said she'd been thinking about that in the last couple of months ("...making a copy of everything to a USB drive..." she said), but whatever workflow is exposed to "normies" for that is apparently unfriendly because she said it "told her she'd have to save each document as a Word or Excel file".
She's not technical but I'm also willing to bet the "set yourself up to migrate away from our platform" workflow in the Workspace product isn't particularly streamlined either.