Google Says Reports Of A Gmail Breach Have Been Greatly Exaggerated

Panic spread faster than a phishing email on Tuesday after claims of a massive Gmail breach hit the headlines – but Google says it’s all nonsense.

The ad giant moved quickly to quash reports that more than 183 million Gmail accounts had been compromised in a “major security breach.” The claims, which appeared in numerous outlets including The Daily Mail, The Mirror, Forbes, The Independent, and the New York Post, are “false,” according to Google, which blamed the fuss on a misunderstanding of old, recycled credentials rather than evidence of an intrusion.

Google nukes 3,000 YouTube videos that sowed malware disguised as cracked software

READ MORE

The confusion appears to have started after Have I Been Pwned (HIBP) creator Troy Hunt announced he had added a large dataset of 183 million credentials to the breach notification service. The data was shared with Hunt by Synthient, a threat intelligence platform that collects and analyzes information from infostealer malware logs. As Hunt explained in a blog post, the collection reflects years of infostealer activity rather than a single new compromise – and certainly not a targeted attack on Gmail.

Google echoed that point on X. “Reports of a ‘Gmail security breach impacting millions of users’ are false. Gmail’s defenses are strong, and users remain protected,” the company said. It added that the data circulating online “is stemming from a misunderstanding of infostealer databases, which routinely compile various credential theft activity occurring across the web.”

Infostealer databases, which are continuously aggregated from infected browsers, phishing kits, and cracked software, often contain Gmail addresses simply because so many users reuse them across the internet. When such collections resurface, they’re frequently misinterpreted – or sensationalized – as fresh breaches.

Google said it regularly scans for large caches of stolen credentials and prompts affected users to reset passwords when necessary. “Gmail takes action when we spot large batches of open credentials, helping users reset passwords and resecure accounts,” the company noted.

Hunt was also perplexed by the widespread coverage the so-called “breach” had received. “I think they’re deliberately misleading and designed to drive eyeballs on ads whilst the truth gets buried somewhere further down in the story,” he said. 

For users, the takeaway is straightforward: enable two-step verification, switch to passkeys if possible, and update passwords that appear in breach notifications.

Still, the incident shows how quickly a nuanced data point can morph into a headline-grabbing “breach.” In this case, the only thing truly compromised was the context – and perhaps a few editors’ understanding of what a leak actually is. ®

Original Source