A leaked Google export archive from this incident means someone received another person's Photos videos inside their own Takeout download. Google Takeout, the "Download your data" export tool, packages selected account data into ZIP or TGZ files for download.
To inventory it, work offline: extract the archive, open archive_browser.html, then map per-service folders and timestamps to services and date ranges. The underlying problem involved Photos video exports requested between Nov. 21-25, 2019, when videos were incorrectly placed in unrelated users' archives, as reported by ZDNet's February 2020 report.
Table of Contents
- What leaked and who was affected
- How to open the archive safely
- How to list services and date ranges
- What the archive cannot prove
What leaked and who was affected
Only users who requested a "Download your data" export containing Google Photos content during Nov. 21-25, 2019 were in scope. Google said users with no export request in that period were not affected, according to gHacks reporting.
Recipients could receive an incomplete archive or videos that were not theirs. Google said the Takeout/Photos issue was identified and resolved Nov. 25, 2019, affected less than 0.01% of Photos users who exported in that window, and affected videos only, not photos.
How to open the archive safely
Treat any found archive as sensitive personal data. Copy it to an offline machine, scan it, then inventory it before sharing or uploading it.
Extract the ZIP or TGZ files, then open archive_browser.html in a browser. BinaryFork notes that this file lists included services, file counts, total size, formats, and folder structure, as described in BinaryFork's Takeout guide. Takeout exports can span Gmail, Drive, Calendar, Maps, Photos, and YouTube, split large exports into multiple files, and use download links that expire after about 7 days.
How to list services and date ranges
Use filenames, JSON timestamps, MBOX dates, and Photos JSON sidecars before sharing or uploading the data. Start with the top-level folders: each service normally has its own folder.
Then check service formats useful for dating. Unzipped exports use Gmail MBOX, Calendar ICS, Contacts VCF/CSV, Location History JSON/KML, and My Activity HTML/JSON.
- List folders present and note missing expected services
- Record file counts, total size, and formats from archive_browser.html
- Sort Photos files plus JSON sidecars by timestamp
- Scan Gmail MBOX dates, Calendar ICS dates, and Location JSON timestamps for earliest and latest entries
What the archive cannot prove
Takeout reflects data still on Google servers. It may omit raw logs or ad inferences.
Changes between request and archive creation may not be included. So use the archive to inventory what was exported, not to reconstruct every record Google held.
You Might Also Like
- Cybersecurity for Google Data Exports: Why a Download Archive Can Be More Sensitive Than One Document
- WordPress 7.1.2 Security Flaw: What the Advisory Says About Exposure and Breach Evidence
- Not a Hack, Still an Exposure: What the ChatGPT Human-Review Lawsuit Says Contractors Could See