That's the six hundred million dollar question in my mind.<p>How exactly did Google know that those other institutions were under attack?<p>Unless the attack resulted in rooted Google machines that then attacked outward, or all those institutions were running on Google Apps.<p>Major institutions running on Google Apps seems unlikely (Are <i>any</i> major institutions outside of academia running Google Apps hosted by Google?).  And attacking outward from a rooted box inside Google's network seems careless, unless the attackers were leveraging some dedicated pathways that made their job easier.  Which suggests the breach was far more serious than indicated.