Google had confirmed that no passwords were stolen during the breach, but users are now at risk of phishing attempts.