Breaches and incidents
Firebase-hosted phishing of SBI, ICICI Bank and Axis Bank customers (India): I4C orders Google to remove 57 sites and databases
Government notices reviewed by Reuters (one dated 17 Aug 2026) ordered Google to remove at least 57 websites and databases hosted on Firebase.
- Disclosed
- Verification
- Reported by a reputable outlet, citing the company
What happened
- Government notices reviewed by Reuters (one dated 17 Aug 2026) ordered Google to remove at least 57 websites and databases hosted on Firebase. Seven were phishing pages copying State Bank of India, ICICI Bank and Axis Bank; the rest reportedly collected stolen data including card details and one-time passwords (Outlook Business, 21 Aug 2026).
- Root cause: criminals used Google’s Firebase hosting and databases as phishing pages and as drop stores for stolen OTPs and card data.
- Attacker: not named.
- Response: the notices warned Google of liability for links not removed within three hours. Google said it “has strict policies against using its services for phishing, malware and financial fraud.”