Google said they saw a “180% increase in sites getting hacked for spam compared to the previous year”.
Google will now send alerts via Google Analytics when it is suspected that your site has been hacked for spam. These alerts will be similar to the ones received in the Google Search Console message centre but it makes sense to add them to Google Analytics, which has a higher install base, so it can inform a wider webmaster base that their site may be hacked. The alert includes a detailed recovery guide to help fix the issue.
You do not need to be verified in Google Search Console to get these alerts in Google Analytics. However, it is recommended to still verify a site in Search Console which has even more security features.
A hacked website can often serve malicious malware/software, redirect users to attend a website they didn’t intend to and collect information. Google Search may label your website as ‘this site may be hacked’ or serve an older, safer version of your site while it is thought to be compromised.