Gmail users put on red alert after millions of passwords stolen in huge data breach

A massive database containing login details of more than 183 million Gmail accounts has been leaked online and added to the cyber-security platform Have I Been Pwned (HIBP) — raising global concerns about widespread account vulnerability.

Cybersecurity researcher and HIBP founder Troy Hunt confirmed that the dataset — which also includes passwords — was compiled from stealer logs and credential-stuffing lists circulating among cyber-criminals.

The breach follows a string of high-profile cyberattacks this year, including those targeting major international companies such as Jaguar Land Rover and Marks & Spencer.

According to reporting by Forbes, the compromised data appears to originate from a breach first detected in April 2025. The credentials are not believed to come from a single company, but rather years-long harvesting of stolen personal data.

In all, HIBP says it has now indexed 3.5 terabytes of stolen information representing 231 billion records — most of it collected through the Synthient threat-intelligence project, which tracks infostealing malware.

A sample review of 94,000 breached records revealed:

92% were previously known data leaks

8% (about 16.4 million credentials) are newly exposed

Cyber experts describe this discovery as “extremely serious,” because millions of users are only now learning they have been compromised — and some Gmail passwords in the dataset still worked when tested.

Gmail accounts pose a particularly high risk because they serve as a gateway to:

• online banking
• cloud storage
• social media
• work emails and mobile services

One compromised Gmail login could therefore give criminals access to multiple other linked accounts.

Google has not yet issued an official statement on the incident.

✅ How to check if you were affected

1️⃣ Visit HaveIBeenPwned.com
2️⃣ Enter your Gmail address
3️⃣ If your account appears in the results → immediately change your password

Cybersecurity experts strongly advise:
✅ Enable two-factor authentication (2FA)
✅ Use unique passwords for each online service
✅ Store strong passwords in a reputable password manager
✅ Avoid logging into key accounts on public Wi-Fi
✅ Monitor suspicious login attempts

A growing digital threat landscape

The breach serves as yet another reminder that even the world’s biggest tech platforms are not immune to cybercrime — especially when hackable credentials are stolen from users rather than company servers.

As digital dependency increases globally, security analysts warn that password reuse remains the weakest link — putting millions at unnecessary risk.