December 5, 2025
Child-lock, no unlock
Google 'Looking into' Gmail Hack Locking Users Out with No Recovery
Hacker flips Gmail’s “child lock” and chaos erupts — commenters say ditch Big Tech
TLDR: A hacker can trap a Gmail account by making it a child in their “family,” blocking recovery, and Google says it’s investigating. Commenters are split between ditching Gmail for personal domains and slamming passkeys that depend on the same account—everyone agrees: don’t buy gift cards for ransom.
A wild Gmail saga lit up the Gmail subreddit: a hacker changed a victim’s account age to 10, stuffed it into the hacker’s “family,” and boom—parental controls became a padlock. Recovery options? Zero. The ransom? Gift cards. Google told Forbes it’s “looking into it,” but the internet didn’t wait—the comments exploded with panic, jokes, and Big Tech side-eye.
The loudest chorus: why are we still on Gmail? Some pushed personal domains and DIY email, while an industry pro sighed that giant companies split feature teams from anti‑abuse teams, and this is what happens—clever bad guys slip through. Passkeys—those phone-based login keys—also got roasted: if they live in your Google account, getting locked out is worse, not better. And yes, the thread even turned into an editing roast after a clunky line in the story—“Good god what happened to editors?” became a mini‑meme. People dubbed it the child‑lock hostage hack, serving both drama and dread. The vibe: equal parts outrage and eye‑rolls, with users debating self‑hosting vs reality, and begging Google for a fix. Until guidance arrives, commenters say: lock down settings, beware weird “family” invites, and absolutely do not pay in gift cards.
Key Points
- •Attackers change a victim’s Google account age to under 13 and add it to an attacker-controlled Google family group as a child.
- •Designating the compromised account as a child locks the owner out and disables standard Google recovery options.
- •A victim reported the scenario on the Gmail subreddit, with attackers demanding gift cards for account release.
- •Google stated it is “looking into” the issue and plans to issue specific guidance in the near future.
- •Gmail has 2 billion active users, underscoring the potential reach of such abuse if not addressed.