As an administrator for your organization, you’ll receive an alert if a user is detected as a possible victim of a government-backed attack.

What is a government-backed attack alert? We send the alert to let you know that we believe government-backed attackers are trying to access the account of one of your users. An attack happens to less than 0.1% of all Google Account users.

There's a chance the alert is a false alarm. However, we believe we detected activities that government-backed attackers use to try to steal a password or other personal information. Such activity includes the user receiving an email containing a harmful attachment, links to malicious software downloads, or links to fake websites that are designed to access passwords.

We can’t reveal what tipped us off because the attackers will take note and change their tactics. If they're successful, they could access data or take other actions using the user's account. You should take steps to secure the user's account from the attack.