Google API Keys Exposed + 308K Travelers Breached: This Week's Biggest Threats

Two major security incidents this week expose why hardened security practices matter at every layer. From developer mistakes to delayed breach notifications, here's what you need to know.

Millions of Android Apps Leaking Google API Keys to Attackers

Developers have been hardcoding Google API keys directly into Android apps, and those keys now work with Google's Gemini AI service. That means attackers can pull these keys from decompiled apps, use them to access Gemini resources, steal any user data uploaded to the service, and drain developer quotas. The impact is massive: this affects potentially millions of Android apps and exposes sensitive documents and cached files to unauthorized access. If you use apps that integrate with Google services, this is a sign that even "invisible" backend integrations can become attack vectors if not properly secured.

Read more

Eurail Breach Exposes 308,000 Travelers' Passport Numbers and Health Data

Threat actors breached Eurail in December 2025 and stole passport numbers, dates of birth, bank account details, health information, and travel records for over 308,000 customers—including young travelers from the DiscoverEU program. The data surfaced for sale on the dark web weeks later, but Eurail didn't notify victims until April, a two-month gap that left people vulnerable to identity theft without warning. If you travel in Europe or used Eurail's Rail Planner app, you should change your passwords immediately and alert your bank about potential fraud, since attackers now have enough personal data to impersonate you.

Read more

Stay ahead of threats with GOCO Security at gocosecurity.com