Michele Spagnuolo, a Google security engineer, allegedly used privileged access to an internal tool containing confidential "Year in Search" data to place bets on Polymarket, a cryptocurrency-based decentralized prediction market. Starting in October 2025, Spagnuolo used the alias "AlphaRaccoon" to bet on whether specific individuals would appear on Google's top trending search lists, leveraging confidential data to achieve near-perfect betting accuracy. After Google's public announcement of the Year in Search results in December 2025, Spagnuolo's Polymarket account collected approximately $1.2 million in winnings. Authorities traced the account and subsequent money movements through cryptocurrency-swapping services. The U.S. Attorney and CFTC have filed criminal and civil charges respectively, seeking penalties including prison time, restitution, and trading bans.

The impact is primarily legal and reputational rather than a technical vulnerability. The insider misused confidential business information to gain illicit financial profits of approximately $1.2 million. This incident exposes risks related to insider threats and misuse of privileged access to confidential data. There is no indication of a technical vulnerability or compromise of Google's systems beyond the insider misuse. No known exploits or broader security impacts have been reported.

This is an insider threat case involving misuse of confidential data rather than a software vulnerability. No patches or technical fixes apply. Organizations should enforce strict access controls, monitor for anomalous insider behavior, and ensure compliance with insider trading laws and corporate policies. Legal proceedings are ongoing, and no direct remediation for a software vulnerability is required.