If you have ever shared your Google Calendars, or maybe inadvertently, with someone that should not be publicly accessible anymore, you should immediately go back to your Google settings and check if you’re exposing all your events and business activities on the Internet accessible to anyone.

At the time of writing, there are over 8000 publicly accessible Google Calendars, searchable using Google engine itself, that allow anyone to not only access sensitive details saved to them but also add new events with maliciously crafted information or links, security researcher Avinash Jain told The Hacker News.

“Warning — Making your calendar public will make all events visible to the world, including via Google search. Are you sure?”

Avinash Jain, a security researcher from India working in an e-commerce company, Grofers, who previously found vulnerabilities in other platforms like NASA, Google, Jira, and Yahoo.

“I was able to access public calendars of various organizations leaking out sensitive details like their email ids, their event name, event details, location, meeting links, zoom meeting links, google hangout links, internal presentation links and much more,” Avinash says in a post exclusively shared with The Hacker News.

Well, since it’s intended behavior of the Calendar Service that comes as a handy feature to collaborate with people by making a Calendar public, one can not directly blame Google for the exposed data.

“While this is more of an intended setting by the users and intended behavior of the service but the main issue here is that anyone can view anyone public calendar, add anything on it—just by a single search query without being shared the calendar link,” Avinash says.

Also, the issue is really not new, instead it was first raised 12 years ago when Google added this “make it public” feature to its web-based calendar service as a cool way for users to discover exciting events through the search engines, but a few quick searches revealed sensitive corporate information that was inadvertently made public using Google Calendar.

As the researcher says, since Google doesn’t notify the creator of a public Calendar when someone accesses it or adds an event to it, the feature makes it harder for users to know if they are exposing information unintentionally and are even open to spammers and phishers as well.

Besides this, there’s also no graphical indication on the Calendar interface from where users can get a hint that they had made that Calendar public and should stop adding personal events to the same.

Using an advanced Google search query (Google Dork), one can list all publicly available Calendars within seconds and access every information, including sensitive corporate data belonging to some organizations, as shown in the screenshots shared by Avinash.

“Various calendars belonged to many of the top 500 Alexa company’s employees as well, which intentionally/unintentionally were made public by the employee themselves,” Avinash warns.

A few months ago, security firm Kaspersky also discovered scammers abusing Google Calendar service to target users with credential-stealing attacks, where phishers were sending victims an email containing a crafted event invitation with malicious links.

In case if a user wants to share a Calendar with someone privately, Google also allows users to invite specific users by adding their email addresses under Calendar settings, instead of making them accessible to the public.

Share your calendar with someone

You can share your calendar with family, friends, and co-workers.

• Share your main calendar with someone so they can find your schedule.
• Create a calendar that multiple people can edit, like a family calendar.
• Add someone, like an administrative assistant, as a delegate of your calendar to schedule and edit events for you.

Important: Use caution if you share your calendar. Anyone with full permission will be able to respond to invitations, create and edit events, and share your calendar with others.

Share your calendar

In Google Calendar, you can have multiple calendars that you add events to. Each calendar can have different sharing settings.Share an existing calendar

You can share the main calendar for your account, or another calendar you created. Learn how to create a new calendar.

Tips:

• If you’d like to share a calendar that you don’t own, you’ll need to ask the owner to turn on the Make changes and manage sharing permission. 
• If your account is managed through work or school, you might not have access to all of the permissions options. To learn more, contact your admin.

1. On your computer, open Google Calendar. You can’t share calendars from the Google Calendar app. 
2. On the left, find the “My calendars” section. You might need to click it to expand it. 
3. Hover over the calendar you want to share, click More   Settings and sharing.
   • To broadly share it: Under “Access permissions,” check the boxes of the ways you want to share and choose your options in the drop-down menu. Learn more about these options below.
   • To share with individuals: Under “Share with specific people,” click Add people.
4. Add the person or Google group email address. Use the dropdown menu to adjust their permission settings.
5. Click Send.

If you share your calendar with a group, it isn’t automatically added to their “Other calendars” list. Instead, they’ll need to click the link in the email they got to add the calendar to their list. The calendar sharing settings will automatically adjust to any changes in the group’s membership over time. Learn more about Google Groups.

Share with people who don’t have Google Calendar

The only way to let people who don’t have Google Calendar view your calendar is to make it public. Learn more about sharing publicly.