Startup Necromancy: Exploiting Abandoned Google Apps Domains

A security researcher discovered a critical vulnerability: improperly shutting down Google Workspace accounts leaves defunct startup domains vulnerable. New owners can reactivate former employees' Google accounts, granting access to third-party services (Slack, ChatGPT, Zoom, etc.) accessed via Google OAuth. Sensitive data, including tax documents and internal communications, becomes exposed. Google initially dismissed it, but after the researcher's Shmoocon presentation, they reevaluated, offering a bounty. This highlights the risk of insufficient account closure procedures and potential weaknesses within OAuth authentication.