The worst thing about things like this happening is the feeling of helplessness when you can't reach anyone in the company or when they just say "it's not a problem".
https://news.ycombinator.com/threads?id=ritikk
https://news.ycombinator.com/threads?id=ritikk2
https://news.ycombinator.com/threads?id=ritikk3
https://news.ycombinator.com/threads?id=ritikk4
(Should I add the 5th link or wait for him to create that ID as well?)
The security team is very responsive but for normal users there is no way to communicate with Google.