A significant cybersecurity incident has exposed login credentials for over 183 million email accounts, including many Gmail users, according to the security firm Have I Been Pwned (HIBP) and a Forbes report.
Check here to see if you are affected.
The breach was not caused by a direct hack of any platform; rather, it resulted from data collected through “infostealer” malware and credential-stuffing lists. Security researcher Troy Hunt confirmed that the dataset contains valid Gmail account credentials.
Key Findings
- The leaked dataset spans approximately 3.5 terabytes and includes about 23 billion rows of data.
- Around 8 percent of the credentials—more than 16 million—were previously unseen in earlier breaches, while the remaining 92 percent were recycled from older data.
Although many entries originated from previous leaks, the existence of entirely new Gmail logins presents a fresh risk for users.
Why the Risk Is High
A compromised Gmail password can grant attackers access not only to email contents but also to linked services such as cloud storage, social media accounts, work accounts, and financial applications. Credential-stuffing attacks, where the same login details are used across multiple sites, become more effective when passwords are reused.
Recommended Actions
Security professionals recommend the following steps:
- Enter your email address on Have I Been Pwned to check if your credentials appear in the breach.
- If your email address is listed, change your password immediately and do the same for any accounts that use that password.
- Enable two-factor authentication (2FA) on all important accounts, and consider using passkeys or hardware security keys.
- Use a reliable password manager and avoid reusing passwords across different sites.
While the breach originates from malware-based collection rather than a direct attack on Google services, the inclusion of confirmed Gmail credentials increases its severity. The widespread reuse of passwords makes this compromise particularly dangerous. Users and organizations should act swiftly to secure their accounts and evaluate their password practices.
